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Let T : N Z be defined by: 

n>0 n>l 

Then we have, in Z/19Z: 



t(101""" + 1357) 


= ±4, 


t(101°™ + 7383) 


= ±2, 


t(101°™ + 21567) 


-±3, 


r(10i°™ + 27057) 


= 0, 


r(10^°°° + 46227) 


= 0, 


r(10^°°° + 57867) 


= 0, 


r(10"°° + 64749) 


= ±7, 


r(10^°°° + 68367) 


= 0, 


r(10^°°° + 78199) 


= ±8, 


t(10^°°° + 128647) 


= 0. 



Section 7.5, Lemma 7.4.1, and [Magma], [SAGE] and [PARI]. 
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Preface 



This is a book about computational aspects of modular forms and the Galois 
representations attached to them. The main result is the following: Galois 
representations over finite fields attached to modular forms of level one can, 
in almost all cases, be computed in polynomial time in the weight and the 
size of the finite field. As a consequence, coefficients of modular forms can 
be computed fast via congruences, as in Schoof 's algorithm for the number 
of points of elhptic curves over finite fields. The most important feature of 
the proof of the main result is that exact computations involving systems of 
polynomial equations in many variables are avoided by approximations and 
height bounds, i.e., bounds for the accuracy that is necessary to derive exact 
values from the approximations. 

The books authors are the two editors, Jean-Marc Couveignes and Bas 
Edixhoven, together with Johan Bosman, Robin de Jong, and Franz Merkl. 
Each chapter has its own group of authors. 

Chapter 1 gives an introduction to the subject, precise statements of the 
main results, and places these in a somewhat wider context. Chapter 2 pro- 
vides the necessary background concerning modular curves and modular 
forms. Chapter 3 gives a first, informal description of the algorithms. These 
first three chapters should allow readers without much background in arith- 
metic geometry to still get a good idea of what happens in the book, skip- 
ping, if necessary, some parts of Chapter 2. 

Chapters 4 and 5 provide the necessary background on heights and 
Arakelov theory, and on algorithmic aspects of the computation with a de- 
sired accuracy of the roots of complex polynomials and power series. 

Chapters 6 and 7 are concerned with some real computations of Galois 
representations attached to modular forms, and end with a table deaUng with 
all cases of forms of weight at most 22 and finite fields of characteristic at 
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most 23. 

The main ingredients for the proof of the main resuU are estabhshed in 
Chapters 8, 9, 10, 11, 12, and 13. The topics dealt with are, respectively: 
construction of suitable divisors on modular curves, bounding heights using 
Arakelov theory, bounding Arakelov invariants of certain modular curves, 
approximation of divisors using complex numbers, and using finite fields. 

The main result on the computation of Galois representations is proved 
in Chapter 14, where one finds a detailed description of the algorithm and a 
rigorous proof of the complexity bound. 

Chapter 15 contains the application of the main result to the computation 
of coefficients of modular forms. 

The Epilogue announces some work on generahsations and apphcations 
that will be completed in the near future, as well as a direction of further 
research outside the context of modular forms. 
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Chapter One 



Introduction, main results, context 

B. Edixhoven 



1,1 STATEMENT OF THE MAIN RESULTS 

As the final results in this book are about fast computation of coefficients of 
modular forms, we start by describing the state of the art in this subject. 

A convenient way to view modular forms and their coefficients in this 
context is as follows, in terms of Hecke algebras. For N and k positive 
integers, let Sk{^i{N)) be the finite dimensional complex vector space of 
cuspforms of weight k on the congruence subgroup Fi ( A^) of SL2 (Z) . Each 
/ in Sk{Ti{N)) has a power series expansion / = X^„>i an{f)q^, a com- 
plex power series converging on the unit disk. These a„(/) are the coef- 
ficients of / that we want to compute, in particular for large n. For each 
positive integer n we have an endomorphism T„ of Sk{^i{N)), and we let 
T(A, k) denote the sub-Z-algebra of End(S'fc(ri(A)) generated by them. 
The T(A, k) are commutative, and free Z-modules of rank the dimension 
of S'fe(ri(A)), which is of polynomially bounded growth in N and k. For 
each N, k and n one has the identity a„(/) = a\{Tnf). The C-valued pair- 
ing between S'fc(ri(A^), C) and T(A^, k) given by (/, t) ^ ai{tf) identifies 
Sk{Ti{N), C) with the space of Z-linear maps from T(A, k) to C, and we 
can write f{Tn) for an{f)- AH together this means that the key to the com- 
putation of coefficients of modular forms is the computation of the Hecke 
algebras T(A, k) and their elements T^. A modular form / in Sk{Ti{N)) 
is determined by the f{Ti) with i < A;-[SL2(Z) : ri(iV)]/12, hence if is 
known as a Z-Unear combination of these Tj, then /(T„) can be computed 
as the same Z-hnear combination of the /(Tj). 
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The state of the art in computing the algebras T(A^, k) can now be sum- 
marised as follows. 

There is a deterministic algorithm, that on input positive inte- 
gers N and k > 2, computes T(N, k): it gives a Z-basis and 
the multiplication table for this basis, in running time polyno- 
mial in N and k. Moreover, the Heche operator Tn can be ex- 
pressed in this Tj-basis in deterministic polynomial time in N, 
k and n. 

We do not know a precise reference for this statement, but it is rather obvi- 
ous from the Uterature on calculations with modular forms for which we 
refer to William Stein's book [Ste2], and in particular to Section 8.10.2 
of it. The algorithms alluded to above use that Sk{Ti{N)), viewed as 
M-vector space, is naturally isomorphic to the R-vector space obtained 
from the so-called "cuspidal subspace" H^(ri(A'^), Z[x, ?/]fc_2)cusp of the 
Z-module }l^{ri{N),Ij[x,y]k-2) in group cohomology. Here, Z[x,y]fc_2 
is the homogeneous part of degree k—2 of the polynomial ring Z[x,y] 
on which SL2(Z) acts via its standard representation on Z[x,y]i. In this 
way, H^(ri(A'"), Z[x, y]k-2)cusp, modulo its torsion subgroup, is a free Z- 
module of finite rank that is a faithful T{N, A;)-module, and the action of the 
Tn is described explicitly. Algorithms based on this typically use a presen- 
tation of H^(ri(A^), Z[x, y]A;_2)cusp in terms of so-called "modular sym- 
bols", and we call them therefore modular symbols algorithms. The theory 
of modular symbols was developed by Birch, Manin, Shokurov, Cremona, 

Merel, It has led to many algorithms, implementations and calculations, 

which together form the point of departure for this book. 

The computation of the element r„ of T{N, k), using modular symbols 
algorithms, involves sums of a number of terms that grows at least linearly 
in n. If one computes such sums by evaluating and adding the terms one by 
one, the computation of T„, for and k fixed, will take time at least linear 
in n, and hence exponential in log n. The same is true for other methods 
for computing Tn that we know of: computations with g-expansions that 
involve multiplication of power series, using hnear combinations of theta 
series, the "graph method" of Mestre and Oesterle, and the Lefschetz trace 
formula for correspondences, holomorphic or not. Efforts to evaluate the en- 
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countered sums more quickly seem to lead, in each case, again to the prob- 
lem of computing coefficients of modular forms. For example, the graph 
method leads to the problem of computing quickly representation numbers 
of integer quadratic forms in 4 variables. In the case of the trace formula, 
there are maybe only 0(-v/n) terms, but they contain class numbers of imag- 
inary quadratic orders, these numbers being themselves directly related to 
coefficients of modular forms of half integral weight. 
Let us now state one of the main results in this book. Theorem 15.2.1. 

Assume that the generalised Riemann hypothesis ( GRH) holds. 
There exists a deterministic algorithm that on input positive in- 
tegers n and k, together with the factorisation of n into prime 
factors, computes the element Tn o/T(l,fc) in running time 
polynomial in k and log n. 

The restriction to modular forms of level 1 in this result is there for a tech- 
nical reason. The result will certainly be generalised to much more general 
levels; see the Epilogue at the end of this book. The condition that the fac- 
torisation of n into primes must be part of the input is necessary because we 
do not have a polynomial time algorithm for factoring integers. Vice versa, 
see Remark 2.2.4 for evidence that factoring is not harder than computing 
coefficients of modular forms. 

Let us describe how the computation of Galois representations is used for 
the computation of T„. Standard identities express Tn in terms of the Tp for 
p dividing n. These Tp are computed, via the LLL basis reduction algorithm, 
from sufficiently many of their images under morphisms / from T(l, fc) to 
finite fields, analogously to Schoof's algorithm for counting points of an 
elUptic curve over a finite field. Indeed, for such an / : T{l,k) F, with 
p not the characteristic, I, say, of F, the image f{Tp) is equal to the trace of 
Pf (Fiohp), where pf-. Gal(Q/Q) — )■ GL2(F) is the Galois representation 
attached to /, and pj(Frobp) a Frobenius element at p. The representation 
pj is characterised by the following three conditions: it is semi-simple, it is 
unramified outside /, and for all prime numbers p ^ I one has: 

trace(p/(Probp)) = /(Tp) and det(p/(Probp)) = /"^ in F. 

It is the main result of this book. Theorem 14.1.1, plus some standard com- 
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putational number theory, that enables us to compute pj(Frobp) in time 
polynomial in k, #F and logp (note the log!). Under GRH, existence of 
sufficiently many maximal ideals of small enough index is guaranteed. We 
partly quote Theorem 14.1.1. 

There is a deterministic algorithm that on input a positive 
integer k, a finite field ¥, and a surjective ring morphism f 
fi-om T(l, /c) to F such that the associated Galois representa- 
tion pf : Gal(Q/Q) — >■ GL2(F) is reducible or has image con- 
taining SL2(F), computes pf in time polynomial in k and #F. 

By "computing pf" we mean the following. Let Kf c Q be the finite Galois 
extension such that pf factors as the natural surjection from Gal(Q/Q) to 
Gal{Kf/Q), followed by an injection into GL2(F). Then to give pf means 
to give Kf as Q-algebra, in terms of a multiplication table with respect to a 
Q-basis, together with a list of all elements of Gal(K/ /Q), as matrices with 
coefficients in Q, and, for each a in Gal{Kf /Q), to give the corresponding 
element pf{a) of GL2(F). 

Before we describe in more detail, in the next sections, some history and 
context concerning our main results, we give one example and we make 
some brief remarks. Many of these remarks are treated with more detail 
further on. 

The first non-trivial example is given by A; = 12. The space of cuspidal 
modular forms of level one and weight 12 is one-dimensional, generated by 
the discriminant modular form A, whose coefficients are given by Ramanu- 
jan's T-function: 

ra>l n>l 

In this case, the Hecke algebra T(l, 12) is the ring Z, and, for each n in 
Z>o, we have r„ = r(ra). The results above mean that: 

for p prime, Ramanujan's rip) can be computed in time poly- 
nomial in log p. 

For I prime, let pi denote the Galois representation to GL2(F;) attached 
to A. It was proved by Swinnerton-Dyer that for I not in {2, 3, 5, 7, 23, 691} 
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the image of pi contains SL2(Fi). This means that for all I not in this short 
list the representation pi has non-solvable image, and so cannot be com- 
puted using computational class field theory. The classical congruences for 
Ramanujan's r-function correspond to the I in the Ust above. Our results 
provide a generaUsation of these congruences in the sense that the number 
fields Ki that give the pi "encode" the r(p) mod / in such a way that t{p) 
mod I can be computed in time polynomial in I and log p, i.e., just the same 
complexity as in the case where one has explicit congruences. 

More generally, we hope that non-solvable global field extensions whose 
existence and local properties are imphed by the Langlands program can be 
made accessible to computation and so become even more useful members 
of the society of mathematical objects. Exphcit descriptions of these fields 
make the study of global properties such as class groups and groups of units 
possible. Certainly, if we only knew the maximal abelian extension of Q 
as described by general class field theory, then roots of unity would be very 
much welcomed. 

The natural habitat for Galois representations such as the p / above is that 
of higher degree etale cohomology with F^-coefficients of algebraic vari- 
eties over Q, together with the action of Gal(Q/Q). Our results provide 
some evidence that, also in interesting cases, such objects can be computed 
in reasonable time. We stress that this question is not restricted to varieties 
related to modular forms or automorphic forms. In fact, thinking of ellip- 
tic curves, over Q, say, knowing that these are modular does not help for 
computing their number of points over finite fields: School's algorithm uses 
algebraic geometry, not modularity. 

The problem of computing etale cohomology with Galois action is clearly 
related to the question of the existence of polynomial time algorithms for 
computing the number of solutions in ¥p of a fixed system of polynomial 
equations over Z, when p varies. Our results treat this problem for the 11- 
dimensional variety that gives rise to A; see Section 1.5 for more details and 
also for an explicit variety of dimension 19 related to this. 

The Epilogue at the end of this book describes a striking appUcation of 
a generaUsation of our results to the problem of computing representation 
numbers of the equipped with the standard inner product. This again 
is an example where only for small k there are explicit formulas, but where 
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in general there (surely) exists an algorithm that computes such numbers 
as quickly as if such formulas did exist. Hence, from a computational per- 
spective, such algorithms form a natural generalisation of the finite series of 
formulas. 

We very briefly describe the method by which we compute the pf. Their 
duals occur in the higher degree etale cohomology of certain higher dimen- 
sional varieties, but no-one seems to know how to compute with this directly. 

Via some standard methods in etale cohomology (the Leray spectral se- 
quence, and passing to a finite cover to trivialise a locally constant sheaf 
of finite dimensional F^-vector spaces), or from the theory of congruences 
between modular forms, it is well known that the p/ are realised by sub- 
spaces Vf in the Z-torsion Ji (Q) [I] of the Jacobian variety Ji of some mod- 
ular curve Xi defined over Q. The field Ki is then the field generated by 
suitable "coordinates" of the points x ^ Vi C Ji{Q)[l]- We are now in the 
more familiar situation of torsion points on abelian varieties. But the price 
that we have paid for this is that the abelian variety Ji depends on /, and 
that its dimension, equal to the genus of Xi, i.e., equal to {I — 5){l — 7)/24, 
grows quadratically with I. This makes it impossible to directly compute 
the X e Vi using computer algebra: known algorithms for solving systems 
of non-hnear polynomial equations take time exponential in the dimension. 

Instead of using computer algebra directly, Jean-Marc Couveignes sug- 
gested that we use approximations and height bounds. In its simplest form, 
this works as follows. Suppose that x is a rational number, x = a/b, 
with a and 6 in Z coprime. Suppose that we have an upper bound M 
for max(|a|,|6|). Then x is determined by any approximation y e M. 
of x such that |y — a;| < 1/2M^, simply because for all x' ^ x with 
x' = a'/b', where a' and 6' in Z satisfy m£Lx(|a'|, < M, we have 
\x' -x\ = \{a'b - ab')/bb'\ > 

For the computation of Ki, we consider the minimal polynomial Pi 
in Q[T] of a carefully theoretically constructed generator a of i^^;. We use 
approximations of all Galois conjugates of a, i.e., of all roots of Pi. Instead 
of working directly with torsion points of J;, we work with divisors on the 
curve Xi. Using this strategy, the problem of showing that P; can be com- 
puted in time polynomial in I is divided into two different tasks. Firstly, 
to show that the number of digits necessary for a good enough approxima- 
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tion of Pi is bounded by a fixed power of I. Secondly, to show that, given I 
and n, the coefficients of Pi can be approximated with a precision of n digits 
in time polynomial in n-l. The first problem is dealt with in Chapters 9, 10, 
and 11, using Arakelov geometry. The second problem is solved in Chap- 
ters 12 and 13, in two ways: complex approximations (numerical analysis), 
and approximations in the sense of reductions modulo many small primes, 
using exact computations in Jacobians of modular curves over finite fields. 
These five chapters form the technical heart of this book. The preceding 
chapters are meant as an introduction to them, or motivation for them, and 
the two chapters following them give the main results as relatively straight- 
forward applications. 

Chapters 6 and 7 stand a bit apart, as they are concerned with some real 
computations of Galois representations attached to modular forms. They use 
the method by complex approximations, but do not use a rigorously proven 
bound for a sufficient accuracy. Instead, the approximations provide good 
candidates for polynomials Pi. The Pi that are found have the correct Ga- 
lois group, and the right ramification properties. Recent modularity results 
by Khare, Wintenberger and Kisin, see [Kh-Wil], [Kh-Wi2], and [Kisl] 
and [Kis2], are then applied to prove that the candidates do indeed give the 
right Galois representations. 

1.2 HISTORICAL CONTEXT: SCHOOF'S ALGORITHM 

The computation of Hecke operators from Galois representations and con- 
gruences can be viewed as a generalisation of Schoof's method to count 
points on elUptic curves over finite fields, see [Sch2] and [Sch3]. Rene 
Schoof gave an algorithm to compute, for E an elliptic curve over a finite 
field ¥g, the number #E{¥g) of F^-rational points in a time 0((log 
His algorithm works as follows. 

The elliptic curve is embedded, as usual, in the projective plane as the 
zero locus of a Weierstrass equation, which, in inhomogeneous coordinates, 
is of the form: 

-I- aixy + a^y = + a2X^ + a^x + a^, 
with the in ¥q. We let Fg be an algebraic closure. We let 
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Fq-. E ^ E denote the so-caUed (7-Frobenius. It is the endomorphism of 
E with the property that for all (a, b) in the affine part of E{¥q) given by 
the Weierstrass equation above we have Fq{{a, b)) = (a'^, 6^). The theory 
of elhptic curves over finite fields says: 

1. there is a unique integer a, called the trace of F^, such that in the 
endomorphism ring of E one has — oFq + q = 0; 



So, computing #E(¥q) is equivalent to computing this integer a. Schoof's 
idea is now to compute a modulo I for small prime numbers Z. If the product 
of the prime numbers I exceeds 4g^/^, the length of the interval in which we 
know a to lie, then the congruences modulo these I determine a uniquely. 
Analytic number theory tells us that it will be sufficient to take all primes I 
up to approximately (log q) /2. 

Then the question is how one computes a modulo I. This should be done 
in time polynomial in log q and I. The idea is to use the elements of order 
dividing I in E{¥q). We assume now that I does not divide q, i.e., we avoid 
the characteristic of F^. For each I, the kernel £^(Fg)[Z] of multipUcation by 
I on E{¥q) is a two-dimensional vector space over F^. The map F^ gives an 
endomorphism of E(¥q)[l], and it follows that the image of a in F; is the 
unique element of F;, also denoted a, such that for each v in £'(Fg)[Z] we 
have aFq{v) = F'^v + qv. We remark that the image of a in F^ is the trace 
of the endomorphism of i?(Fq)[/] given by Fq, but this is not really used at 
this point. 

To find this element a of F;, one proceeds as follows. We suppose that 
I 7^ 2. There is a unique monic element ipi of ¥q[x] of degree — l)/2, 
whose roots in Fg are precisely the x-coordinates of the P — I non-zero 
elements in £'(Fg)[Z] (the rational function x on is a degree two map to 
Pp^, which as such is the quotient for the multiplication by —1 map on E). 
One then lets Ai be the Fg-algebra obtained as: 

Ai := ¥q[x,y]/{y'^ + aixy + a^y - x^ - a-ix^ - a/^x - a%,t\)i{x)). 

The dimension of Ai as F^-vector space is — 1. An equivalent description 



2. 



3. 



#£;(Fg) = 1 - a + 
\a\ < 2^1/2. 
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of Ai is to say that it is the affine coordinate ring of the subscheme of points 
of order I of E. By construction of Ai, there is a tautological yl^-valued 
point V in E{Ai) (its coordinates are the images of x and y in Ai). Now to 
find the element a of that we are looking for one then tries one by one the 
elements i in 0, ±1, . . . , ±{l — l)/2 until iFq{v) = F^v + qv; then i = a 
mod I. 

It is easy to see that all required computations can be done in time 
0((log (using fast arithmetic for the elementary operations, e.g., a 

multiplication in Ai costs about {P{log q)y~^'^ time; ^^(log q) is the number 
of bits needed to store one element of Ai). 

For the sake of completeness, let us mention that shortly after the appear- 
ance of Schoof 's algorithm, Atkin and Elkies have added some improve- 
ments to it, making it possible in certain cases to reduce the dimension of 
the Fg-algebra from P — I to linear in Z + 1 or Z — 1. This improvement, 
called the Schoof-Atkin-Elkies (SEA) algorithm, is important mainly for 
implementations. Its (average) complexity is 0{{logq)^~^'^); for details, the 
reader is referred to [Sch3]. 

1.3 SCHOOF'S ALGORITHM DESCRffiED IN TERMS OF ETALE CO- 
HOMOLOGY 

In order to describe Schoof's algorithm in the previous section, we referred 
to the theory of elliptic curves over finite fields. But there is a more gen- 
eral framework for getting information on the number of rational points of 
algebraic varieties over finite fields: cohomology, and Lefschetz's trace for- 
mula. Cohomology exists in many versions. The version directly related to 
Schoof's algorithm is etale cohomology with coefficients in F/. Standard 
references for etale cohomology are [SGA4], [SGA4.5], [SGA5], [Mill], 
[Fr-Ki]. The reader is referred to these references for the notions that we 
will use below. We also recommend Appendix C of [Hart]. 

For the sake of precision, let us say that we define the notion of algebraic 
variety over a field k to mean k-scheme that is separated and of finite type. 
Attached to an algebraic variety X over a field k there are etale cohomology 
groups with compact supports Hp(Xet, F/), for alH > and for all prime 
numbers I. Actually, the coefficients F; can be replaced by more general 
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objects, sheaves of Abehan groups on the etale site of X, but we do not 
need this now. If X is a proper fc-scheme, then the H* (Xet, F;) are equal to 
the etale cohomology groups H*(Xet, F;) without condition on supports. 

If A; is separably closed then the H*(Xet,F/) are finite dimensional F;- 
vector spaces, zero for i > 2dim(X). In that case, they are the analog of 
the more easily defined cohomology groups H* {X, F) for complex analytic 
varieties: the derived functors of the functor that associates to a sheaf F of 
Z-modules on X equipped with its Archimedean topology its Z-module of 
global sections whose support is compact. 

The construction of the H*(Xet,F;) is functorial for proper morphisms: 
a proper morphism f:X^Yof algebraic varieties over k induces a pull- 
back morphism /* from W^{Y^,¥i) to ff^(Xet, F;). 

Let now X be an algebraic variety over F^. Then we have the qi-Frobenius 
morphism Fg from X to itself, and, by extending the base field from Fg to 
¥q, from to itself. This morphism Fg is proper, hence induces maps: 

: HJ. (Xp^ , F; ) — > HI (Xp^ , F; ) . 

Hence, for each ? in Z, the trace trace (F*, H* (Xp F;)) of the map above 
is defined, and it is zero for z < and i>2 dim(X). The set of fixed points 
of Fq on X(Fg) is precisely the subset X{¥q). The Lefschetz trace formula 
then gives the following identity in F^: 

(1.3.1) #X(F,) = ^(-l)We(F*,H^(X^^_^,,FO). 

i 

We can now say how Schoof's algorithm is related to etale cohomology. 
We consider again an elliptic curve E over a finite field Fg. We assume 
that I does not divide q. Then, as for any smooth proper geometrically con- 
nected curve, H°(£']p ^^jF;) = F/ and F* acts on it as the identity, and 
H^(£|; et' one-dimensional and F* acts on it by multiplication by q, 
the degree of F^. According to the trace formula (1.3.1), we have: 

#E{¥q) = 1 - trace(F;,Hi(£^^_^„F^)) + q. 

It follows that for the integer a of the previous section, the trace of Frobe- 
nius, we have, for all I not dividing p the identity in F;: 

a = trace(F*,Hi(E5^^^^^,F,)). 
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This identity is explained by the fact that there is a natural isomorphism, 
compatible with the action of F^: 

Let us describe how one constructs this isomorphism. On Eet we have the 
short exact sequence of sheaves, called the Kummer sequence: 

> jli )■ Gm > Gm 

where the map on Gm is multiphcation by I in the group law of Gm, i e., 
taking Zth powers. This short exact sequence gives an exact sequence of 
cohomology groups after puUback to E^^ 

Just as for any scheme, one has: 
It follows that 

H'(£f„et.w) = Pic(^^)[Z]. 
Finally, using the exact sequence: 

V\c\E^^) Pic(£^p ^ Z ^ 

and the fact that E is its own Jacobian variety, i.e., Pic°(£|i ) = E(¥q), we 
obtain: 

Hi(^^_,,, W) = V.c{E^Jl] = Pic\E^J[l] = Ei¥,)[l]. 

The choice of an isomorphism between fii{¥q) and gives us the desired 
isomorphism between }i^{E^^ ^^,¥i) and E{¥q)[l]. In fact, we note that 
by using the Weil pairing from E(^q)[l] x E(¥q)[l] to /ii(Fg), we get an 
isomorphism: 

that is more natural than the one used above; in particular, it does not depend 
on the choice of an isomorphism F; — > ni{¥q). 
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1.4 SOME NATURAL NEW DIRECTIONS 

We have seen that the two-dimensional F;-vector spaces that are used in 
Schoof 's algorithm for elhptic curves can also be seen as etale cohomology 
groups. A natural question that arises is then the following. 

Are there other interesting cases where etale cohomology 
groups can be used to construct polynomial time algorithms 
for counting rational points of varieties over finite fields? 

A more precise question is the following. 

Let n and m be in Z>o, and let fi, . . . , be inZ[xi, . . . , x„]. 
Is there an algorithm that on input a prime number p computes 
i^{a G Fp I : fi{a) = 0} in time polynomial in logp.^ 

We believe that the answer to this question is yes, and that the way in which 
such an algorithm can work is to compute etale cohomology. 

1.4.1 Curves of higher genus 

The first step in the direction of this question was taken by Jonathan Pila. In 
[Pil] he considered principally polarised Abehan varieties of a fixed dimen- 
sion, and curves of a fixed genus, and showed that in those cases polyno- 
mial time algorithms for computing the number of rational points over finite 
fields exist. In these cases, the only relevant cohomology groups are in de- 
gree one, i.e., they are of the form H^(Xp F/) with X a smooth proper 
curve, or an Abelian variety, over the field ¥q. As in Schoof 's algorithm, the 
way to deal with these cohomology groups is to view them as J(Fq)[Z], the 
kernel of multiplication by I on the Abehan variety J. In the case where X 
is a curve, one lets J be the Jacobian variety of X. 

As Pila makes use of explicit systems of equations for Abelian varieties, 
his algorithm has a running time that is at least exponential in the dimension 
of the Abelian variety, and hence, in the case of curves, as a function of the 
genus of the curve. 

The current state of affairs concerning the question of counting the ratio- 
nal points of curves over finite fields seems still to be the same: algorithms 
have a running time that is exponential in the genus. As an illustration, let us 
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mention that in [Ad-Hu] Adleman and Huang give an algorithm that com- 
putes #X(Fg) in time (log g)*^^^' ^ogs)^ ^^gj-g x is a hyperelliptic curve 
over ¥q, and where g is the genus of X. 

Recent progress in the case where the characteristic of the finite fields Fg 
is fixed, using so-called p-adic methods, will be discussed in Section 1.6 
below. In that case, there are algorithms whose running time is polynomial 
in g and log q. 

1.4.2 Higher degree cohomology, modular forms 

Another direction in which one can try to generahse Schoof 's algorithm is 
to varieties of higher dimension, where non-trivial cohomology groups of 
degree higher than one are needed. In this context, we would call the degree 
2 cohomology group of a curve trivial, because the trace of Fg on it is q. 

More generally speaking, cohomology groups, but now with ^-adic coef- 
ficients, that are of dimension one are expected to have the property that the 
trace of can only be of the form (/"C with n an integer greater than or 
equal to zero, and C, a root of unity. This means that one-dimensional coho- 
mology groups are not so challenging. Indeed, it is the fact that for elhptic 
curves over Fp all integers in the Hasse interval [p -I- 1 — 2p^/^ ,p+l + 2p^/^] 
can occur that makes the problem of point counting very different from point 
counting on non-singular quadric surfaces in P|^, for example, where the 
outcome can only be + 2q + 1 or + 1. 

It follows that the simplest case to consider is cohomology groups of 
dimension two, in degree at least two, on which the action of Fq is not given 
by a simple rule as in the one-dimensional case. Such cohomology groups 
are provided by modular forms, as we will explain later in Section 2.2. Let 
us just say for the moment, that there is a direct relation with elliptic curves, 
via the concept of modularity of elliptic curves over Q, that we will now 
sketch. 

Let E be an elliptic curve over Q, given by some Weierstrass equation. 
Such a Weierstrass equation can be chosen to have its coefficients in Z. A 
Weierstrass equation for E with coefficients in Z is called minimal if its 
discriminant is minimal among all Weierstrass equations for E with co- 
efficients in Z; this discriminant then only depends on E and will be de- 
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noted discr(£'). In fact, two minimal Weierstrass equations define isomor- 
phic curves in P|, the projective plane over Z. In other words, E has a 
Weierstrass minimal model over Z, that will be denoted by Ez- For each 
prime number p, we let Ef^ denote the curve over Fp given by reducing a 
minimal Weierstrass equation modulo p; it is the fibre of Ez over Fp. The 
curve Ewp is smooth if and only if p does not divide discr(£^). The possi- 
ble singular fibres have exactly one singular point: an ordinary double point 
with rational tangents, or with conjugate tangents, or an ordinary cusp. The 
three types of reduction are called split multiplicative, non-split multiplica- 
tive and additive, respectively, after the type of group law that one gets on 
the complement of the singular point. For each p we then get an integer Up 
by requiring the following identity: 

p+l-ap = #E{¥p). 

This means that for all p, ap is the trace of Fp on the degree one etale co- 
homology of Ej , with coefficients in F;, or in Z/PZ or in the ^-adic num- 
bers Z/. For p not dividing discr(i?) we know that \ap\ < 2p^/^. If E^p is 
multiplicative, then ap = 1 or — 1 in the split and non-split case. If E^^ is 
additive, then Op = 0. We also define, for each p an element in {0, 1} 
by setting £{p) = 1 for p not dividing discr(£^) and setting e{p) = for p 
dividing discr(£?). The Hasse-Weil L-function of E is then defined as: 

Le{s) = YILe,p{s), Le,p{s) = (1 - app-' + £{p)pp-^')-^, 
p 

for s in C with > 3/2 (indeed, the fact that \ap\ < 2p^l'^ implies that 
the product converges for such s). To explain this function more conceptu- 
ally, we note that for all p and for all Z 7^ p we have the identity: 

1 - apt + e[p)pt^ = det(l - tF;,R\E^^^^,qi)) 

The reader should notice that now we use etale cohomology with coeffi- 
cients in Qi, the field of /-adic numbers, and not in F^. The reason for this is 
that we want the last identity above to be an identity between polynomials 
with integer coefficients, and not with coefficients in F;. 

The function Le was conjectured to have a holomorphic continuation 
over all of C, and to satisfy a certain precisely given functional equation 
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relating the values at s and 2 — s. In that functional equation appears a 
certain positive integer Ne called the conductor of E, composed of the 
primes p dividing discr(i?) with exponents that depend on the behaviour of 
E dip, i.e., on E'z^. This conjecture on continuation and functional equation 
was proved for semistable E (i.e., E such that there is no p where E has 
additive reduction) by Wiles and Taylor- Wiles, and in the general case by 
Breuil, Conrad, Diamond and Taylor; see [Edi2] for an overview of this. In 
fact, the continuation and functional equation are direct consequences of the 
modularity of E that was proved by Wiles, Taylor- Wiles etc. (see below). 
The weak Birch and Swinnerton-Dyer conjecture says that the dimension of 
the Q-vector space Q (8) -©(Q) is equal to the order of vanishing of Le at 1. 
Anyway, the function Le gives us integers a„ for all n > 1 as follows: 

Le{s) = ^ ann'\ for 3ft(s) > 3/2. 

n>l 

From these an one can then consider the following function: 

: H = {r G C I 9(r) > 0} ^ C, r ^ ^ ane^"**^. 

n>l 

Equivalently, we have: 

fE = Y^ with g : H ^ C, r ^ e^""'^ . 

n>l 

A more conceptual way to state the relation between Le and /e is to say 
that L^; is obtained, up to elementary factors, as the Mellin transform of /e'- 

/ fE{it)f- = {2^r'T{s)LE{s), for3i(s) >3/2. 
Jo t 

After all these preparations, we can finally state what the modularity of E 
means: 

/e is a modular form of weight two for the congruence jm^j- 
groupFoiNE) of SL2{Z). 

For some more details on the concept of modular forms we refer to Sec- 
tion 2.2. At this moment, we just want to say that the last statement means 
that /e has, as Mazur says in Singh's BBC documentary on Wiles's proof 
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of Fermat's Last Theorem, an enormous amount of symmetry. This sym- 
metry is with respect to the action of GL2(Q)"'", the group of invertible 2 
by 2 matrices with coefficients in Q whose determinant is positive, on the 
upper half plane H. This symmetry gives, by Mellin transformation, the 
functional equation of Le- Conversely, it had been proved in [Weil] by 
Weil that if sufficiently many twists of L^; by Dirichlet characters satisfy 
the conjectured holomorphic continuation and functional equation, then 
is a modular form of the type mentioned. 

We now remark that Schoof 's algorithm implies that, for p prime, the 
coefficient Up in the (/-expansion of /e — X^7i>i ^n^"^ can be computed in 
time polynomial in log p. One of the aims of the research project described 
in this report is to generahse this last fact to certain modular forms of higher 
weight. Before we give precise definitions in Section 2.2, we will discuss a 
typical case in the next section. 

1.5 MORE mSTORICAL CONTEXT: CONGRUENCES FOR RAMANU- 
JAN'S r-FUNCTION 

References for this section are the articles [Ser2], [Swi] and [Dell] by Serre, 
Swinnerton-Dyer and Deligne. 

A typical example of a modular form of weight higher than two is the 
discriminant modular form, usually denoted A. One way to view A is as 
the holomorphic function on the upper half plane H given by: 



where q is the function from H to C given by z i-> exp(27ri2;). The coeffi- 
cients in the power series expansion: 



(1.5.1) 



A = gJ](l-«") 



n>l 



(1.5.2) 




n>l 



define the famous Ramanujan r-function. 

To say that A is a modular form of weight 12 for the group SL2 (Z) means 
that for all elements ( " ^ ) of SL2(Z) the following identity holds for all z 
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in H: 

which is equivalent to saying that the multi-differential form A{z){dz)'^^ 
is invariant under the action of SL2(Z). As SL2(Z) is generated by the 
elements (J }) and {i~q), it suffices to check the identity in (1.5.3) for 
these two elements. The fact that A is times a power series in q means 
that A is a cusp form: it vanishes at "gr = 0". It is a fact that A is the 
first example of a non-zero cusp form for SL2(Z): there is no non-zero 
cusp form for SL2(Z) of weight smaller than 12, i.e., there are no non-zero 
holomorphic functions on H satisfying (1 .5.3) with the exponent 12 replaced 
by a smaller integer, whose Laurent series expansion in g is g times a power 
series. Moreover, the C-vector space of such functions of weight 12 is one- 
dimensional, and hence A is a basis of it. 

The one-dimensionality of this space has as a consequence that A is an 
eigenform for certain operators on this space, called Hecke operators, that 
arise from the action on H of GL2(Q)"'", the subgroup of GL2(Q) of ele- 
ments whose determinant is positive. This fact explains that the coefficients 
r(n) satisfy certain relations which are summarised by the following iden- 
tity of Dirichlet series (converging for 3fi(s) S> 0, for the moment, or just 
formal series, if one prefers that): 

(1.5.4) La{s) := rin)n-' = - T{p)p-' 

n>l p 

These relations: 

T{mn) = T[ra)T[n) if gcd(m, n) = 1 

(1.5.5) 

r(p") = T(p"'~^)r(p) - p^^r(p"~^) if p is prime and n > 2 

were conjectured by Ramanujan, and proved by Mordell. Using these iden- 
tities, r(n) can be expressed in terms of the r(p) for p dividing n. 

As La is the Mellin transform of A, La is holomorphic on C, and satis- 
fies the functional equation (Hecke): 

(27r)-(^2-")r(12 - s)La(12 - s) = {2'k)-'V{s)La{s). 
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The famous Ramanujan conjecture states that for all primes p one has the 
inequality: 

(1.5.6) |r(p)|<2/V2^ 

or, equivalently, that the complex roots of the polynomial x'^ — t{p)x + p^^ 
are complex conjugates of each other, and hence are of absolute value p^^/^. 
This conjecture was proved by Deligne as a consequence of his arti- 
cle [Dell] and his proof of the analog of the Riemann hypothesis in the 
Weil conjectures in [Del2]. 

Finally, Ramanujan conjectured congruences for the integers t{p) withp 
prime, modulo certain powers of certain small prime numbers. In order to 
state these congruences we define, forn > 1 and r > 0: 

ar{n) := ^ (f, 

l<d\n 

i.e., ar{n) is the sum of the rth powers of the positive divisors of n. We will 
now hst the congruences that are given in the first pages of [Swi]: 



r(n) = 


C7ii(n) 


mod 2^^ 


ifn = 1 


mod 8 


r(n) = 


1217(711 (n) 


mod 2^^ 


ifn = 3 


mod 8 


r(n) = 


1537(711 (n) 


mod 2^^ 


if n = 5 


mod 8 


r(n) = 


705(711 (n) 


mod 2^"^ 


ifn = 7 


mod 8 


T(n) = 


n-«^°(7i23i(n) 


mod 3^ 


if n = 1 


mod 3 


T(n) = 


n-^^°(7i23i(n) 


mod 3^ 


if n = 2 


mod 3 


T(n) = 


n-^°(77i(n) 


mod 5^ 


if n is prime to 5 



T(n) = nagin) mod 7 if n = 0, 1, 2 or 4 mod 7 

r(n) = nag{n) mod 7^ if n = 3, 5 or 6 mod 7 
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r{p) = 


mod 23 


if p is prime and not a square mod 23 


r{p) = 2 


mod 23 


if p 7^ 23 is a prime of the form + 23v^ 


r(p) = -1 


mod 23 


for other primes p ^ 23 




r(n) 


= o-nin) mod 691 



The reader is referred to [Swi] for the origin and for proofs of these con- 
gruences. There, Swinnerton-Dyer remarks that the proofs do little explain 
why such congruences occur. Serre conjectured an explanation in [Ser2]. 
First of all, Serre conjectured the existence, for each prime number I, of a 
continuous representation: 

(1.5.7) PI : Gal(Q/Q) Aut(Vi), 

with Vi a two-dimensional -vector space, such that pi is unramified at all 
primes p ^ I, and such that for all p ^ I the characteristic polynomial of 
Pi{Ftohp) is given by: 

(1.5.8) det(l -xProbp, V;) = 1 - T{p)x+p^^x^. 

To help the reader, let us explain what unramified at p means, and what the 
Frobenius elements Frobp are. For p prime, we let Qp denote the topo- 
logical field of jo-adic numbers, and Qp — > Qp an algebraic closure. The 
action of Gal(Q/Q) on the set Hom(Q,Qp) of embeddings of Q into % 
is transitive, and each embedding induces an injection from Gal(Qp/Qp) 
into Gal(Q/Q), the image of which is called a decomposition group of 
Gal(Q/Q) at p. The injections from Gal(Qp/Qp) into Gal(Q/Q) and the 
corresponding decomposition groups at p obtained like this are all conju- 
gated by the action of Gal(Q/Q). In order to go further we need to say a bit 
about the structure of Gal(Qp/Qp). We let Q^"'' be the maximal unramified 
extension of Qp in Q^, i.e., the composite of all finite extensions K of Qp 
in Qp such that p is a uniformiser for the integral closure Ok of Zp in K. 
We let Zp"'' be the integral closure of Zp in Qp""^; it is a local ring, and its 
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residue field is an algebraic closure ¥p of ¥p. The sub-extension Q^^^ gives 
a short exact sequence: 

(1.5.9) Ip-^ Gal(Qp/Qp) ^ Gal(Fp/Fp). 

The subgroup Ip of Gal(Qp/Qp) is called the inertia subgroup. The quotient 
Gal(Fp/Fp) is canonically isomorphic to Z, the profinite completion of Z, 
by demanding that the element 1 of Z corresponds to the Frobenius element 
Probp of Gal(Fp/Fp) that sends x to for each x in Fp. 

Let now pi be a continuous representation from Gal(Q/Q) to GL(V/) 
with Vi a finite dimensional Q/-vector space. Each embedding of Q into 
Qp then gives a representation of Gal(Qp/Qp) on Vi. Different embed- 
dings give isomorphic representations because they are conjugated by an 
element in the image of Gal(Q/Q) under pi. We now choose one embed- 
ding, and call the representation p; p of Gal(Qp/Qp) on Vi obtained like 
this the local representation at p attached to pi. This being defined, pi is 
then said to be unramified at a prime p if /?/ p factors through the quotient 
Gal(Qp/Qp) Gal(Fp/Fp), i.e., if Ip acts trivially on Vi. If pi is un- 
ramified at p, then we get an element pi{Frohp) in GL(V;). This element 
depends on our chosen embedding of Q into Qp, but its conjugacy class un- 
der p;(Gal(Q/Q)) does not. In particular, we get a well-defined conjugacy 
class in GL(V;), and so the characteristic polynomial of pi(FTohp) is now 
defined if pi is unramified at p. 

Continuous representations such as pi can be reduced modulo powers of 
I as follows. The compactness of Gal(Q/Q) implies that with respect to a 
suitable basis of Vi the representation pi lands in GL2(Z;), and hence gives 
representations to GL2(Z//"Z) for all n > 0. This reduction of pi modulo 
powers of I is not unique, but the semi-simplification of the reduction mod- 
ulo I is well-defined, i.e., two reductions lead to the same Jordan-Holder 
constituents. According to Serre, the congruences above would then be ex- 
plained by properties of the image of pi. 

For example, if the image of the reduction modulo I of pi is reducible, say 
an extension of two characters a and /3 from Gal(Q/Q) to F^^ , then one has 
the identity in ¥i, for all p / 



(1.5.10) 



t{p) = a(Probp) + /3(Probp). 
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The characters a and /? are unramified outside I. By the Kronecker- Weber 
theorem, the maximal Abelian subextension of Q — > Q that is unramified 
outside I is the cyclotomic extension generated by all ^-power roots of unity, 
with Galois group 1,^ . It then follows that a = %" and ^ = for suitable 
n and m, where xi is the character giving the action on the Zth roots of 
unity in Q: for all a in Gal(Q/Q) and for all C in with C' = 1 one has 
cr(C) = Q^i'y"). The identity (1.5.10) in F/ above then takes the form: 

(1.5.11) T{p)=f'-^f modi, forallj9/i, 

which indeed is of the same form as the congruences mod I for r(p) listed 
above. For example, the congruence mod 691 corresponds to the statement 
that the reduction modulo I of pi contains the two characters 1 and -y^^ . 

Deligne, in [Dell], proved the existence of the pi, as conjectured by Serre, 
by showing that they occur in the degree one /-adic etale cohomology of cer- 
tain sheaves on certain curves, and in the degree 11 etale cohomology with 

-coefficients of a variety of dimension 11. This last variety is, loosely 
speaking, the 10-fold fibred product of the universal elhptic curve. Deligne's 
constructions will be discussed in detail in Sections 2.2 and 2.4. It should 
be said that Shimura had already shown how to construct Galois representa- 
tions in the case of modular forms of weight two; in that case one does not 
need etale cohomology, but torsion points of Jacobians of modular curves 
suffice, see [Shil]. 

At this point we give the following precise statement, relating Ramanu- 
jan's r-function to point counting on an algebraic variety Cio (more pre- 
cisely, a quasi-projective scheme over Z), for which one easily writes down 
a system of equations. Moreover, the statement relates the weight of A to 
the classical question in geometry on cubic plane curves passing through a 
given set of points: up to 9 points the situation is easy and the count is given 
by a polynomial. 

1.5.12 Proposition For n G Z>o, g a prime power and ¥q a finite field witli 
q elements, let Cn(¥q) be the set of (C, Pi, ... , P„), where C is a smooth 
cubic in P|^, and Pi G C{¥q). Then there are fo, ■ ■ ■ , fio € Z[x] such that 
for allFqandn <9 one has #Cn(Fg)/#PGL3(Fq) = /„(g), and for all 
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prime numbers p: 



#Cio(Fp) / #PGL3(Fp) = -r(p) + ho{p). 



Proof For n in Z>o and Fg a field with q elements, let <5n(Fg) denote the 
category, and also its set of objects, of {E/¥g, Pi, . . . , Pn), where E/¥q 
is an elliptic curve, and Pi G E{¥q); the morphisms are the isomorphisms 
(f): E ^ E' such that (piPi) = Pi- For each n, the category £^„(Fg) has 
only finitely many objects up to isomorphism, and one defines: 



where, in the sum, one takes one x per isomorphism class. It is well known 
(see [Dell], [Beh]) that forn < 9 the functions q i— > #£n{¥q) are given by 
certain elements fn in and that there is an /lo in Z[x] such that for all 
prime numbers p one has #£io{¥p) = —t{p) + fio{p). In view of this, the 
claims in Proposition 1.5.12 are a consequence of the following equahty, for 
all n G Z>o and all prime powers q: 



for all n G Z>o and all F,: #C„(Fg) = #PGL3(F,) • #f„(F,). 



We prove (1.5.13) by comparing the subsets on both sides in which the un- 
derlying curves are fixed. 

Let n G Z>o and q a prime power. Let F be a nonsingular projective 
geometrically irreducible curve of genus one over ¥q, and let Eq be its Ja- 
cobian. Then F is an Eq-Iotsot. By Lang's theorem, Theorem 2 of [Lan2], 
F{¥q) is not empty. 

Let Cn{¥q)F be the subset of Cn{¥q) consisting of the (C, Pi,. . . ,Pn) 
with C isomorphic to F. The number of C in that are isomorphic 
to F is the number of embeddings i: F ^ P^^, divided by #Aut(F). 
Such embeddings are obtained from line bundles £. of degree 3 on F, to- 
gether with a basis, up to F^ , of C{F). Hence the number of embeddings 
is #PGL3(Fg) • #Eo{¥q). The group Aut(F) has the subgroup of transla- 
tions, Eo{¥q), with quotient Aut(£^o)- So we find: 




(1.5.13) 



#Cn{¥q)F = #PGL3(F,) • {#Eo{¥q)r /# Aut{Eo). 
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On the other hand, let £n{¥q)E„ be the full subcategory of £n{¥q) with 
objects the (£'0, Pi,..., Pn), with Pi in EQ{¥q). The group Aut(£;o) acts 
on the set of objects of £n{¥q) Eq, and this action is the set of morphisms in 
£n(^q)Eo- This means that: 

#£n{¥g)Eo = {#Eo{¥g)r/#Aut{Eo). 

Summing over the isomorphism classes of F gives (1.5.13). □ 

1.5.14 Remark The polynomials /„ mentioned in Proposition 1.5.12 have 
been computed by Carel Faber and Gerard van der Geer. Their result is: 

/o = X, 

fi = x'^ + X, 

/2 = ar^ + Sar^ + X - 1, 

h = x'^ + + Gx^ - 2a; - 3, 

/4 = x^ + lOx^ + 20a;^ + Ax"^ - Ux - 7, 

h = x^ + 15x^ + 50x^ + 40a;^ - SOx^ - 49x - 15, 

/e = x'^ + 21x^ + 105x^ + 160x'^ - 183x^ - 139x - 31, 

/7 = x^ + 28x'^ + 196x*^ + 469x^ + 280x'^ - 427x^ - TOOx^ 

- 356x — 63, 

/g = + 36x^ + 336x^ + 1148x^ + 1386x^ - 406x'^ - 2436x3 

- 2224x^ - 860x - 127, 

fg = + 45x^ + 540x^ + 2484x'^ + 4662x^ + 1764x^ - 6090x^ 

- 9804x3 _ 63722^2 _ 2003x - 255, 

/lo = + 55x^° + 825x^ + 4905x^ + 12870x'^ + 12264x^ 

- 9240x^ - 33210x'^ - 33495x3 - 17095x2 - 4553x - 511. 

We refer to Birch [Bir] for results on the distribution of the number of ratio- 
nal points on elliptic curves over finite fields, that also make r(p) appear. 

In [Swi], Swinnerton-Dyer gives results, partly resulting from his corre- 
spondence with Serre, in which the consequences of the existence of the pi 
for congruences of t{p) modulo I are explored. A natural question to ask is 
if there are primes I other than 2, 3, 5, 7, 23 and 691 modulo which there 
are similar congruences for r(p). 
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For each p ^ I, t{p) is the trace of /3/(Frobp), and the determinant of 
p;(Frobp) equals p^^. Hence, a polynomial relation between r(p) and p^^, 
vaUd modulo some Z" for all p 7^ I, is a relation between the determinant 
and the trace of all pi{Frohp) in GL2(Z/PZ). But Chebotarev's theorem 
(see [Lan6], or [Ca-Fr], for example) implies that every element of the image 
of Gal(Q/Q) in GL2(Z/rZ) is of the form Frobp for infinitely many p. 
Hence, such a polynomial relation is then valid for all elements in the image 
of Gal(Q/Q) in GL2(Z//"Z). For this reason, the existence of non-trivial 
congruences modulo /" as above for t{p) depends on this image. 

The image of Gal(Q/Q) in under detop; is equal to the subgroup 
of 11th powers in . To explain this, we note that det opi is a continuous 
character from Gal(Q/Q) to Z^, unramified outside I, and such that Probp 
is mapped to p^^ for all p this implies that det opi is the 11th power of 
the Z-adic cyclotomic character xi '■ Gal(Q/Q) , giving the action of 

Gal(Q/Q) on the /-power roots of unity. 

In order to state the results in [Swi], one calls a prime number / excep- 
tional (for A j if the image of pi, taking values in GL2(Zi), does not con- 
tain SL2(Z;). For I not exceptional, i.e., such that the image of pi contains 
SL2(Z/), the image of Gal(Q/Q) in GL2(Z/) x Zf , under (pi,x/), is the 
subgroup H of elements (5,*) such that det(p) = i}-^. This subgroup H 
maps surjectively to x Fj^ under {g^t) ^ {tTace{g),t), and therefore 
there can be no congruence for r(jo) modulo / as above. 

The Corollary to Theorem 4 in [Swi] states, among others, that the list of 
primes that are exceptional for A is {2, 3, 5, 7, 23, 691}. The main tool that 
is used and that we have not discussed is the theory of modular forms mod- 
ulo /, or, equivalently, the theory of congruences modulo I between modular 
forms. As a consequence, there are no similar congruences for t{p) modulo 
primes other than the ones listed above. The special form of the congruences 
modulo 23 is explained by the fact that in that case the image of Gal(Q/Q) 
in GL2(F23) is dihedral; in the other cases the residual representation, i.e., 
the representation to GL2(F;), is reducible. In the case / = 2, Swinnerton- 
Dyer has determined the image of Gal(Q/Q) in GL2(Z2) exactly: see the 
appendix in [Swi]. 

The direction in which we generalise Schoof's algorithm is to give an 
algorithm that computes for prime numbers I that are not exceptional for 
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A the field extension Q ^ Ki that corresponds to the representation of 
Gal(Q/Q) to GL2(Fi) that comes from A. The field Ki is given in the 
form Q[x]/{fi). The computation has a running time that is polynomial 
in /. It is fair to say that this algorithm makes the mod I Galois represen- 
tations attached to A accessible to computation, at least theoretically. As 
the field extensions that are involved are non-solvable, this should be seen 
as a step beyond computational class field theory, and beyond the case of 
elliptic curves, in the direction to make the results of Langlands's program 
accessible to computations. 

As a consequence, one can compute r(p) mod I in time polynomial in 
logp and I, by reducing fi as above mod p and some more computations 
that will be described later (see Section 15.1). By doing this for sufficiently 
many I, just as in Schoof's algorithm, one then gets an algorithm that com- 
putes t{p) in time polynomial in logp. 

In Section 15.2 the method used here is generalised to the case of mod- 
ular forms for SL2 (Z) of arbitrary weight. The main result there is Theo- 
rem 15.2.1. 

1.6 COMPARISON WITH p-ADIC METHODS 

Before we start seriously with the theory of modular forms and the Galois 
representations attached to them in the next chapter, we make a comparison 
between our generalisation of Schoof's algorithm and the so-called p-adic 
methods that have been developed since 2000 by Satoh [Sat], Kedlaya [Ked] 
(see also [Edi3]), Hubrechts, [Hub]), Lauder and Wan [La-Wal], [La-Wa2], 
[Laul] and [Lau2], Fouquet, Gaudry, Giirel and Harley [Fo-Ga-Ha], 
[Ga-Gu], Denef and Vercauteren and Castryk [De-Ve], [Ca-De-Ve], Mestre, 
Lercier and Lubicz [Le-Lu], Carls, Kohel and Lubicz, [Ca-Ko-Lu], [Ca-Lu], 
and Gerkmann, [Gerl] and [Ger2]. Actually, we should notice that such 
a method was already introduced in [Ka-Lu] in 1982, but that this article 
seems to have been forgotten (we thank Fre Vercauteren for having drawn 
our attention to this article). 

In all these methods, one works with fields of small characteristic p, hence 
of the form with q = p^ and p fixed. All articles cited in the previous 
paragraph have the common property that they give algorithms for comput- 
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ing the number of Fg-rational points on certain varieties X over ¥q, using, 
sometimes indirectly, cohomology groups with p-adic coefficients, whence 
the terminology "p-adic methods". 

For example, Satoh [Sat] uses the canonical hft of ordinary elhptic curves 
and the action of the hfted Frobenius endomorphism on the tangent space, 
which can be interpreted in terms of the algebraic de Rham cohomology of 
the lifted curve. Kedlaya [Ked] uses Monsky-Washnitzer cohomology of 
certain affine pieces of hyperelliptic curves. In fact, all cohomology groups 
used here are de Rham type cohomology groups, given by complexes of 
differential forms on certain p-adic lifts of the varieties in question. Just as 
an example, let us mention that Kedlaya [Ked] gives an algorithm that for 
fixed p 7^ 2 computes the zeta functions of hyperelliptic curves given by 
equations: 

where / has arbitrary degree, in time deg(/)^. The running times of 
the other algorithms are all similar, but all have in common that the running 
time grows at least linearly in p (or linear in 0(p^/^), in [Harv]), hence 
exponentially in log p. The explanation for this is that somehow in each case 
non-sparse polynomials of degree at least hnear in p have to be manipulated. 

Summarising this recent progress, one can say that, at least from a the- 
oretical point of view, the problem of counting the solutions of systems of 
polynomial equations over finite fields of a fixed characteristic p and in a 
fixed number of variables has been solved. If p is not bounded, then almost 
nothing is known about the existence of polynomial time algorithms. 

A very important difference between the project described here, using 
etale cohomology with coefficients in F;, and the p-adic methods, is that 
the Galois representations on F^-vector spaces that we obtain are global in 
the sense that they are representations of the absolute Galois group of the 
global field Q. The field extensions such as the Ki = Q[x]/{fi) arising 
from A discussed in the previous section have the advantage that one can 
choose to do the required computations over the complex numbers, approx- 
imating or p-adically at some suitable prime p, or in ¥p for sufficiently 
many small p. Also, as we have said already, being able to compute such 
field extensions Ki, that give mod I information on the Frobenius elements 
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at all primes p ^ l,is very interesting. On the other hand, the p-adic meth- 
ods force one to compute with p-adic numbers, or, actually, modulo some 
sufficiently high power of p, and it gives information only on the Frobe- 
nius at p. The main drawback of the etale cohomology with F; -coefficients 
seems to be that the degree of the field extensions as Ki to be dealt with 
grows exponentially in the dimension of the cohomology groups; for that 
reason, we do not know how to use etale cohomology to compute ^X{¥q) 
for X a curve of arbitrary genus in a time polynomial in log q and the genus 
of X. Nevertheless, for modular curves, see the end of Section 15.3. 
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Chapter Two 



Modular curves, modular forms, lattices, Galois 
representations 

B. Edixhoven 



2.1 MODULAR CURVES 

As a good reference for getting an overview of the theory of modular curves 
and modular forms we recommend the article [Di-Im] by Fred Diamond 
and John Im. This reference is quite complete as results are concerned, 
and gives good references for the proofs of those results. Moreover, it is 
one of the few references that treats the various approaches to the theory of 
modular forms, from the classical analytic theory on the upper half plane to 
the more modem representation theory of adelic groups. Another good first 
introduction could be the book [Di-Sh]. Let us also mention that there is a 
forthcoming book [Conr] by Brian Conrad, and also the information in the 
wikipedia is getting more and more detailed. 

In this section our aim is just to give the necessary definitions and results 
for what we need later (and we need at least to fix our notation). Readers 
who want more details, or more conceptual explanations are encouraged to 
consult [Di-Im]. 

2,1.1 Definition For n an integer greater than or equal to one we let r(n) 
be the kernel of the surjective morphism of groups SL2(Z) — > SL2(Z/nZ) 
given by reduction of the coefficients modulo n, and we let Ti{n) be the 
inverse image of the subgroup of SL2(Z/nZ) that fixes the element (1,0) 
of {'L/nlf. Similarly, we let ro(n) be the inverse image of the subgroup 
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of SL2(Z/nZ) that fixes the subgroup Z/nZ-(l, 0) of {Z/nlf. Hence the 
elements of Tq (n) are the ( " ^ ) of SL2 (Z) such that c = mod n, those 
of Fi (n) are the ones that satisfy the extra conditions a = 1 mod n and 
d = 1 mod n and those of r(n) are the ones that satisfy the extra condition 
6 = mod n. 

The group SL2(M) acts on the upper half plane H by fractional hnear trans- 
formations: 



The subgroup SL2 (Z) of SL2 (M) acts discontinuously in the sense that for 
each z in H the stabiliser SL2(Z)2 is finite and there is an open neighbour- 
hood U oi z such that each translate with 7 in SL2 (Z) contains exactly 
one element of the orbit SL2(Z)-2; and any two translates and 7'C/ with 
7 and 7' in SL2(Z) are either equal or disjoint. This property implies that 
the quotient SL2(Z)\EI, equipped with the quotient topology and with, on 
each open subset U, the SL2(Z)-invariant holomorphic functions on the in- 
verse image of U, is a complex analytic manifold of dimension one, i.e., 
each point of the quotient has an open neighbourhood that is isomorphic to 
the complex unit disk. Globally, the well-known j-function from H to C is 
in fact the quotient map for this action. One way to see this is to associate to 
each z in H the elliptic curve Ez := C/(Z + Zz), and to note that for z and 
z' in H the elliptic curves and E-^i are isomorphic if and only if z and z' 
are in the same SL2(Z)-orbit, and to use the fact that two complex elliptic 
curves are isomorphic if and only if their _7-invariants are equal. 

The quotient set r(n)\EI can be identified with the set of isomor- 
phism classes of pairs {E, (f)), where is a complex elliptic curve and 
0: {Ta/h'Z)'^ — )■ E[n] is an isomorphism of groups, compatible with the 
Weil pairing E[n] x E[n] — )■ ;^n(C) and the ;[/„(C) -valued pairing on 
{Z/nZf that sends ((ai, 02), (61, 62)) to where Cn = e^'^'/"- 

The quotient ro(n)\EI is then identified with the set of pairs {E, G) where 
is a complex elliptic curve, and G C E a subgroup that is isomorphic 
to Z/nZ. Equivalently, we may view ro(n)\]HI as the set of isomorphism 
classes of Ei % E2, where is a morphism of complex elhptic curves, and 
ker(^) is isomorphic to Z/nZ. 
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Finally, the quotient ri(n)\H is then identified with the set of pairs 
(E, P) where £^ is a complex elliptic curve, and P is a point of order n 
of E. Explicitly: to each ^; in H corresponds the pair (C/ (Zz + Z), [1/n]), 
where [1/n] denotes the image of 1/n in C/ {Zz + Z). 

In order to understand that the quotients considered above are in fact the 
complex analytic varieties associated with affine complex algebraic curves, 
it is necessary (and sufficient!) to show that these quotients can be com- 
pactified to compact Riemann surfaces by adding a finite number of points, 
called the cusps. As the quotient by SL2 (Z) is given by j : H ^ C, it can 
be compactified easily by embedding C into P^(C); the point 00 of P^(C) 
is called the cusp. Another way to view this is to note that the equivalence 
relation on H given by the action of SL2 (Z) identifies two elements z and 
z' with Q{z) > 1 and ^{z') > 1 if and only if z' = z + n for some n in Z; 
this follows from the identity, for all ( ^ ^ ) in SL2 (M) and z in H: 

az + b\ ^(z) 



(2 1 2) 

^ ' ' ' ^ \cz + dj \cz + d\'' 

Indeed, if moreover c 7^ 0, then: 



|cz + d|2 - (SJ(cz))2 c^^{z)' 

Hence on the part "Q{z) > 1" of EI the equivalence relation given by 
SL2(Z) is given by the action of Z by translation. As the quotient for 
that action is given by the map q: M ^ D{0, e^'^'^)* , z 1— > exp(27riz), 
where L>(0, e^^Tr^j* ^^lc open disk of radius e centred at 0, and with 
removed, we get an open immersion of D{0,e~'^'^)* into SL2(Z)\EI. 
The compactification is then obtained by replacing Z)(0,e 2^^)* with 
D{0, e"'^'^), i.e., by adding the centre back into the punctured disk. 

Let us now consider the problem of compactifying the other quo- 
tients above. Let T be one of the groups considered above, or, in fact, 
any subgroup of finite index in SL2(Z). We consider the morphism 
/: r\EI -> SL2(Z)\EI = C, and our compactification ¥^{C) of C. By 
construction, / is proper (i.e., the inverse image of a compact subset of C 
is compact). Also, we know that ramification can only occur at points with 
j-invariant or 1728. Let D* be the punctured disk described above. Then 
f : f~^D* ^ D* is aa unramified covering of degree #SL2 (Z) /T if F does 
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not contain —1, and of degree (#SL2(Z)/r)/2 if —1 is in F. Up to isomor- 
phism, the only connected unramified covering of degree n, with n > 1, of 
D* is the map L>; D*, with = {z £ C\0 < \z\ < e'"^'^!'"}, sending 
z z". It follows that f~^D* is, as a covering of D*, a disjoint union 
of copies of such D* D*. Each D* has the natural compactification 
Dn-- {z eC\ \z\ < e-^'^/"}. We compactify r\ll by adding the origin 
to each punctured disk in f~^D*. The points that we have added are called 
the cusps. By construction, the morphism /: r\EI — SL2(Z)\IH extends 
to the compactifications. It is a fact that a compact Riemann surface can be 
embedded into some projective space, using the theorem of Riemann-Roch, 
and that the image of such an embedding is a complex algebraic curve. This 
means that our quotients are, canonically, the Riemann surfaces associated 
with smooth complex algebraic curves. 

2.1.4 Definition For n > 1 we define X{n), Xi{n) and Xo{n) to be the 
proper smooth complex algebraic curves obtained via the compactifications 
of r(n)\EI, ri(n)\EI, and ro(n)\H, respectively. The affine parts obtained 
by removing the cusps are denoted Y{n), Yi{n) and Yo{n). 

The next step in the theory is to show that these complex algebraic curves 
are naturally defined over certain number fields. Let us start with the Xo{n) 
and Xi{n), which are defined over Q. A simple way to produce a model of 
Xo{n) over Q, i.e., an algebraic curve Xo(ra)Q over Q that gives Xo{n) via 
extension of scalars via Q ^ C, is to use the map: 

(i,/) : M ^ C X C, z^ ij{z),j{nz)). 

This map factors through the action of ro(n), and induces a map from 
Xo{n) to X that is birational to its image. This image is a curve 
in P^ X P^, hence the zero locus of a bi-homogeneous polynomial often 
denoted the minimal polynomial of j' over C(j). One can then check, 
using some properties of the j-function, that has integer coefficients. 
The normalisation of the curve in Pq x P^ defined by <!>„ is then the de- 
sired curve Xo(n)Q. As has coefficients in Z, it even defines a curve in 
Pg X Pg (here, one has to work with schemes), whose normalisation Xo{n)z 
can be characterised as a so-called coarse moduli space. For this notion, and 
for the necessary proofs, the reader is referred to [Di-Im, n.8], to [De-Ra] 
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and to [Ka-Ma]. One consequence of this statement is that for any alge- 
braically closed field k in which n is invertible, the fc-points of io(?^)z (the 
complement of the cusps) correspond bijectively to isomorphism classes of 
El E2 where ^ is a morphism of elliptic curves over k of which the 
kernel is cychc of order n. 

The notion of moduh space also gives natural models over Z[l/n] of 
Xi{n) and Yi{n). For n > 4 the defining property of Yi{n)^i/n] is not 
hard to state. There is an elliptic curve E over with a point P in 

E{Yi{n)^[i/n]) that has order n in every fibre, such that any pair (E/S, P) 
with S a Z[l/n]-scheme and P in E{S) of order n in all fibres arises by a 
unique base change: 

E >E 

S ^^lHz[l/n] 

that is compatible with the sections P and P. The pair {K/Yl{n)^l/J^^,F) 
is therefore called universal. 

The moduli interpretation of X{n) is a bit more complicated, because 
of the occurrence of the Weil pairing on E[n] that we have seen above. 
The curve X{n) has a natural model -'^('T')z[i/n,Cn] ^^^^ ^[l/'^iCn]- The 
complement of the cusps Y{n)^i/n^(^„] then has an elliptic curve E over it, 
and an isomorphism (j) between the constant group scheme (Z/nZ)^ and 
E[n] that respects the pairings on each side. The pair (E/F(n)2[i/„ ,^^], (f)) 
is universal in the same sense as above. We warn the reader that the notation 
X{n) is also used sometimes for the moduU scheme for pairs {E, (p) where 
(f) does not necessarily respect the pairings on the two sides. 

For n and m in Z>i that are relatively prime we will sometimes view 
Yi{nm)x[i/nm] the moduli space of triples {E/S,Pn,Pm), where S is 
a scheme over Z[l/nm], E/S an elliptic curve, P„ and Pm in E{S) that 
are everywhere (i.e., in every geometric fibre of E/S) of orders n and m, 
respectively. Indeed, for such a triple, P„ + Pm is everywhere of order nm, 
and the inverse construction starting with a point Pnm that is everywhere 
of order nm is given by multiplying with the two idempotents of Z/nmZ 
corresponding to the isomorphism of rings Z/nmZ — > Z/nZ x Z/mZ. 
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2.2 MODULAR FORMS 

Let us now turn our attention to modular forms. It will be enough for us to 
work with modular forms for the congruence subgroups Ti{n). Therefore, 
we restrict ourselves to that case. 

2.2.1 Definition Let n > 1 and k an integer. A (holomorphic) modular 
form for Ti{n) is a holomorphic function /: H ^ C that satisfies the fol- 
lowing properties: 



2. / is holomorphic at the cusps (see below for an explanation). 

A modular form is called a cuspform if it vanishes at the cusps. 

We still need to explain the condition that / is holomorphic at the cusps. 
In order to do that, we first explain what this means at the cusp oo. That 
cusp is the point that was added to the punctured disk obtained by taking 
the quotient of H by the unipotent subgroup (g J), which acts on H by 
translations by integers. The coordinate of that disk is q, the map that sends 
z to exjp{2Triz). Therefore, / admits a Laurent series expansion in q: 

(2.2.2) / = ^ an{f)q^, called the g-expansion at oo. 



With this notation, / is called holomorphic at oo if a„(/) is zero for all 
n < 0, and / is said to vanish at oo if o„(/) is zero for all n < 0. 

To state this condition at the other cusps, we need some description of the 
set of cusps. First, we note that P^(C) - P^(M) is the same as C - R, and 
therefore the disjoint union of EI and its complex conjugate (which explains, 
by the way, that GL2(M)+ acts by fractional linear transformations on H). 
We can then consider H U pi(Q) inside pi(C), with the SL2(Z) action on 
it. Then the subgroup (g i) stabilises the point oo = (1 : 0) of P^(Q), 
and oo can be naturally identified with the origin that we added to the disk 
D* above, because oo is the unique element of (Q) that hes in the clo- 
sure of the inverse image "Q{z) > 1" of D* in H. Then, the images of 



1. for all ^) e ri(n) and for all zGM: 

f{{az + b)/{cz + d)) = {cz + dffiz); 
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the region > 1" under the action of elements of SL2(Z) correspond 

bijectively to the elements of P^(Q) (note that SL2(Z) acts transitively on 
P^(Q) = and also to the maximal unipotent subgroups of SL2(Z) 

(i.e., the subgroups that consist of elements whose eigenvalues are 1). It 
follows that we can identify the set of cusps of Xi{n) with ri(n)\P^(Q), 
and that the images of the region "Q{z) > 1" under SL2(Z) give us punc- 
tured disks around the other cusps. Let 7 = ( " ^ ) be an element of SL2(Z). 
The conditions of holomorphy and vanishing at the cusp 700 = (a : c) 
are then given in terms of the g-expansion of z 1— )■ {cz + d)~^ f{'^z) at 00. 
The group 7^^ri(n)7 contains the group (q T) (indeed, Tiin) contains 
r(n) and that one is normal in SL2(Z)). Therefore, putting H — > C, 
z exp(27r?2;/n), the function z ^ {cz + d)~^f{^z) then has a Laurent 
series expansion in qn, and one asks that this Laurent series is a power series 
(for holomorphy) or a power series with constant term zero (for vanishing). 

The space of modular forms of weight k on Ti{n) will be denoted 
Mk{^i{n)), and the subspace of cuspforms by Sk{^i{n)). We define 
M(ri(n)) to be the direct sum over the k in Z of the Mk{Ti{n)); it is a 
Z-graded commutative C-algebra under pointwise multiplication. 

2.2.3 Example Some simple examples of modular forms for SL2(Z) are 
given by Eisenstein series. For each even A; > 4 one has the function Ek: 




(n,m)^(0,0) 



The g-expansions of these Ek are given by: 



Ek = 1 - — ^(7fe_i(n)g", 



where the Bk are the Bernoulli numbers defined by: 




and where, as before, Ur (n) denotes the sum of the rth powers of the positive 
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divisors of n. In particular, one has the formulas: 

^4 = 1 + 240 ^ fT3(n)g", ^6 = 1 - 504 ^ (^5(71)9", 



A = 



n>l n>l 
- El 



1728 



2.2.4 Remark We note that, from a computational point of view, the coef- 
ficients of with p prime of the Ek are very easy to compute, namely, up 
to a constant factor they are 1 + p'^^^, but that computing the cTfc_i(n) for 
composite n is equivalent to factoring n. This is a strong indication that, for 
computing coefficients a„(/) of a modular form /, there is a real difference 
between the case where n is prime and the case where n is composite. 

Indeed, Denis Charles and Eric Bach have shown that for n = pqa. prod- 
uct of two distinct primes such that T(n) / 0, one can compute p and q 
from n, r(ra) and r(n^) in time polynomial in log n; see [Ba-Ch]. 

The argument is very simple: one uses the identities in (1.5.5) to compute 
the rational number r(p)^/g^^ and notes that the denominator is of the form 
q^ with r odd. According to a conjecture by Lehmer, r(n) 7^ for all 
n G Z>i. See Corollary 7.1.4. 

The Eisenstein series E4 and Eq generate the C-algebra M(SL2(Z)), and 
are algebraically independent: 

M(SL2(Z)) =C[E4,^6]. 

In particular, we have: 

dime Mfc(SL2(Z)) = #{(a, 6) G Z|o | 4a + 66 = k}. 

The space 5fc(ri(n)) can be interpreted as the space of sections of some 
holomorphic line bundle Cusps) on Xi{n), if n > 5 (for n < 4 

the action of ri(n) on H is not free, and for n = 4 there is a cusp whose 
stabiliser is not unipotent): 

(2.2.5) SkiTi{n)) = H°(Xi(ra),a;®'= (-Cusps)), if n > 5. 

This implies that the spaces Sk{Ti{n)) are finite dimensional, and in fact 
zero if A; < because the fine bundle in question then has negative degree. 
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The restriction to Yi (n) of the line bundle giving the weight k forms is given 
by dividing out the action of Ti{n) on C x H given by: 

(2.2.6) (»^):(x,z)^((cz + d)^x,^). 

The extension of this Une bundle over the cusps is then given by decreeing 
that, at the cusp oo, the constant section 1 (which is indeed invariant under 
the translations z z + n) is a generator for the bundle of holomorphic 
forms, and q times 1 is a generator for the bundle of cusp forms. 

The moduli interpretation for Yi{n) can be extended to the holomorphic 
line bundles giving the modular forms as follows. Recall that a point on 
Yi{n) is an isomorphism class of a pair {E,P) with E a complex eUip- 
tic curve and P a point of order n of E. The complex Une at {E, P) of 
the bundle of forms of weight k is then co^'^, the kth tensor power of the 
dual of the tangent space at of In this way, a modular form / of 
weight k for ri(r7) can be described as follows: it is a function that as- 
signs to each {E, P) an element f{E, P) of oj^'', varying holomorphically 
with {E, P), and such that it has the right property at the cusps (being holo- 
morphic or vanishing). The function / has to be compatible with isomor- 
phisms: if (j)'- E ^ E' is an isomorphism, and 0(-P) = P', then f{E, P) 
has to be equal to (0*)®'^/(£^', P'). In what follows we will simply write 
(f)* for {(f)*)^''. 

The fact that / should be holomorphic can be stated by evaluating it on 
the family of elliptic curves that we have over H. Recall that to z in H we 
attached the pair (C/(Zz + Z), Let us denote x the coordinate of C, 

then dx is a generator of the cotangent space at of this elUptic curve. Then 
for / a function as above, we can write: 

(2.2.7) f{{C/{Zz + Z),[l/n])) = Ff{zy{dx)®'', Ff.M^C. 

The function Fj is then required to be holomorphic. The requirement that 
/ is compatible with isomorphisms means precisely that Ff transforms 
under Ti{n) as in Definition 2.2.1 above. The requirement that / van- 
ishes at the cusps is equivalent to the statement that the Laurent expan- 
sions in g-*^/": z exp{2TTiz/n) obtained by evaluating / on all pairs 
{C/{Zz + Z), {az + b)/n), with a and b in Z such that {az + b)/n is of 
order n are in fact power series with constant term zero. 
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The spaces S'fc(ri(n)) are equipped with certain operators, called Hecke 
operators and diamond operators. These operators arise from the fact that 
for every element 7 of GL2(Q)'^ the subgroups ri(n) and 7ri(n)7^^ are 
commensurable, i.e., their intersection has finite index in each of them. The 
diamond operators are then the simplest to describe. For each a in (Z/ nZ) ^ , 
Yi (n) has the automorphism (a) given by the property that it sends {E, P) 
to {E, aP). This action is then extended on modular forms by: 

(2.2.8) {{a)f){E,P)=f{E,aP). 

Similarly, there are Hecke operators on Sk{Vi{n)) for all integers 
m > 1, defined by: 

(2.2.9) {Tmf){E, P) = -Y. '^VC^^, </>(^)), 

where the sum runs over all quotients (p: E ^ E^ of degree m such that 
(t>{P) is of order n. Intuitively, the operator Tm is to be understood as a kind 
of averaging operator over all possible isogenics of degree m. However, 
the normalising factor 1/m is not equal to the inverse of the number of 
such isogenics. Instead, this factor is there to make the Eichler-Shimura 
isomorphism (see (2.4.5)) T^-equivariant. 

Of course, each element / of Sk{Ti{n)) is determined by its q'-expansion 
J2m>i '^m(/)'i'™ at the cusp 00. The action of the Hecke operators can be 
expressed in terms of these g-expansions (see [Di-lm, (12.4.1)]): 

(2.2.10) am{Trf)= J2 d''~\mM{d)f), 

0<d\{r,in) 
(d,n)=l 

for / in Sk(ri{n)), r and m positive integers. 

From this formula, a lot can be deduced. It can be seen that the com- 
mute with each other (but there are better ways to understand this). The 
Z-algebra generated by the for m > 1 and the (a) for a in (Z/nZ)^ is 
in fact generated by the with m > 1, i.e., one does not need the diamond 
operators, and also by the Tp for p prime and the (a) with a in (Z/ nZ) ^ (see 
[Di-Im, §3.5]). The multiphcation rules for the acting on Sk{Ti{n)) can 
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be read off from the formal identity ([Di-lm, §3.4]): 



(2.2.11) J2 Trnm-' = 11(1 - Tpp-' 

m>l p 



2s\-l 



where {p) is to be interpreted as zero when p divides n. The fact that 
the Hecke and diamond operators commute means that they have common 
eigenspaces. Taking m = 1 in (2.2.10) gives: 

(2.2.12) aiiTrf) = arif). 

It follows that if / is a non-zero eigenvector for all Tj., then ai(/) ^ 0, 
so that we can assume that ai(/) = 1. Then, for all r > 1, ar{f) is the 
eigenvalue for . In particular, this means that the common eigenspaces for 
the Tr are one-dimensional, and automatically eigenspaces for the diamond 
operators. Eigenforms with ai(/) = 1 are called normalised eigenforms. 

From (2.2.11) above it follows that for a normalised eigenform / one 
has: 

(2 2 13) ""-^ 

= n(l - a,{f)p-^+p^-'ef{p)p-^T\ 
p 

where £/ : {7^1 nL)^ ^ is the character via which the diamond opera- 
tors act on /, with the convention that (p) = if p divides n. In particular, 
the L-function of a modular form has such an Euler product expansion if and 
only if the modular form is an eigenform for all Hecke operators. 

An element of S'fe(ri(n)) that is a normalised eigenform for all Hecke 
operators is called a newform if the system of eigenvalues ap{f), with p not 
dividing n, does not occur in a level strictly smaller than n, i.e., in some 
Sk{Ti{m)) with m < n (actually, we will see in a moment that one only 
needs to consider the rn's dividing n). The set of newforms in Sk{yi{n)) 
will be denoted Sk{Ti{n)Y''^ . 

Now we want to recall briefly how one obtains a basis of S'fc(ri(n)) 
in terms of the sets of newforms S'fe(ri(m))'^'^™ for m dividing n. For 
details and references to proofs, see [Di-lm, 1.6]. First of all, for each 
n, Sk{yi{n)Y^'^ is a Unearly independent subset of Sk{yi{n)), hence 
finite. For m dividing n and for d dividing n/m, we have a map 
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Bn,m,d- Xi{n) — > Xi{m), whose moduh interpretation is that it maps 
{E,P) to {E/{{n/d)P),d'P), where dd' = n/m. For example, this 
means: 

(2.2.14) Bn,m,d- (C/(Z2 + Z), 1/n) ^ {C/{Zzd + Z), 1/m), 

which means that the cusp oo of Xi (n) is mapped to the cusp oo of Xi (m). 
Each such map Bn,,n,d induces by puUback a map: 

(2.2.15) B;^,,: Sk(T,{m)) ^ Sk{T^{n)). 

In terms of g-expansions at the cusp oo we have, for / in Sk{Ti{m)): 

(2.2.16) SW = E«^(/)«*' 

r>l 

i.e., the effect is just substitution of q by q'^. With these definitions, we can 
describe a basis for Sk{Ti{n)): 

(2.2.17) ]J ]J i?;^,,5fc(ri(m))-- isabasisof5fc(ri(n)). 

m|n d\{n/m) 

In the case where Ti{n) is replaced by ro(n), this kind of basis is due to 
Atkin and Lehner. 

In the sequel, we will also make use of a (hermitian) inner product on the 
5jfc(ri(n)): the Petersson scalar product. It is defined as follows. For / and 
g in S'fe(ri(n)), viewed as functions on H as in Definition 2.2.1 one has: 

(2.2.18) {f,g)=[ f{z)W)y^^, 

^ri(n)\H y 

where the integral over ri(n)\EI means that one can perform it over 
any fundamental domain. Indeed, formula 2.1.2 shows that the function 
z I—)- f{z)g{z)y^ is invariant under Ti{n). 

We also want to explain the definition of (/, g) in terms of the moduh 
interpretation of Sk{yi{n)), if A; > 2. For simplicity, let us suppose n > 5 
now. Then Sk{Pi{n)) is the space of global sections of a;®'^(— Cusps) 
on Xiiji). Now we let $7^ := ^^^j(„) denote the line bundle of holomorphic 
differentials on Xi{n). Then there is an isomorphism, named after Kodaira 
and Spencer: 

(2.2.19) KS: a;®^(— Cusps) ri^, Kodaira-Spencer isomorphism. 
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Explicitly, for / in S2{Ti{n)), viewed as a ri(n)-invariant section of w®^ 
for the family of elliptic curves over H whose fibre at 2; is C/ [Zz + Z) we 
have: 

(2.2.20) KS : /(dx)®^ ^ (27ri)-2/ ^. 

Equivalently, for this family of elhptic curves, the Kodaira-Spencer isomor- 
phism sends (dx)®^ to (2iTi)~'^ {dq) / q. Note that indeed {dx)®'^ and {dq)/q 
transform in the same way under the action of SL2(M). We note that with- 
out / being required to vanish at the cusps, KS(/) could have poles of order 
one at the cusps. The factor (27ri)~^ is to make the isomorphism compatible 
with the coordinates t = exp(27rix) on / {exp{2Triz)) (which is another 
way to write C/ {Zz + Z)), and the coordinate q = exp(27ri2:) on the unit 
disk. In those coordinates, that have a meaning "over Z", which means 
that formulas relating them are power series (or Laurent series) with integer 
coefficients, KS sends {{dt)/t)®'^ to {dq)/q. 

For every complex elliptic curve, the one dimensional complex vector 
space has the inner product given by: 

(2.2.21) («,/3) = ^^aA 

where we interpret a and (5 as translation invariant differential forms 
on E. The factor i/2 is explained by the fact that, for z = x + iy, one 
has dxdy = {i/2)dzdz. Applying this to the family of elliptic curves 
<C/{Zz + Z) over H gives an inner product on the line bundle u on H, 
and also on the Une bundle a; on Yi (n) (recall that we are supposing that 
n > 5). Taking tensor powers and duals, this induces inner products on a;'^*^ 
for all k. The Kodaira-Spencer isomorphism (2.2.20) gives isomorphisms: 

(2.2.22) KS: a;®'=(-Cusps) ^ ® a;®M. 

For / and g in Sk{J^i{n)), now viewed as sections of a;®'^(— Cusps) over 
X\{n), one has: 

(2.2.23) {f,g) = U (KS(/),KS(5)), 

^ JXi{n) 

where the inner product on the left hand side is the Petersson scalar prod- 

(gj/j^ 2) ®(k 2) 

uct (2.2.18), and where for two local sections oji^a^ anda;2(8)a2 
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of (g) jj^yg defined: 

(2.2.24) (a;i®«fM,a;2<8af"-')) = «2)'=-Va^. 

The operators on S'fc(ri(n)) with m relatively prime to n are nor- 
mal: they commute with their adjoint. As a consequence, distinct new- 
forms in 5fc(ri(n)) are orthogonal to each other. On the other hand, the 
basis (2.2.17) above of Sk{Ti{n)) is not orthogonal if it consists of more 
than only newforms. 



2.3 LATTICES AND MODULAR FORMS 



Before we move on to Galois representations attached to modular forms, we 
briefly discuss the relation between modular forms and lattices. 

Let us consider a free Z-module L of finite rank n, equipped with a pos- 
itive definite symmetric biUnear form b: L x L ^ Z. Then := M (g) L 
is an R-vector space of dimension n on which b gives an inner product, and 
hence L is a lattice in the euclidean space Lr. For m in Z the representation 
numbers of (L, h) are defined as: 

(2.3.1) rz,(m) = rL,b{'m) := #{x G L \ b{x,x) = m}. 
In this situation, one considers the theta-function attached to {L,b): 

(2.3.2) Ol = eL,b = Yl = E rL{m)q"'/\ H ^ C, 

xEL m>0 

where q^^^ : H — )• C is the function g^/^ : z >-)• exp(7riz). 

If {L,b) is the orthogonal direct sum of (Li,6i) and (L2,&2) then we 
have: 
(2.3.3) 

6)^ = ^ qK^,x)/2 ^ ^ qbi{xi,Xl)/2+b2(x2,X2)/2 ^ Q^^ . Q^^_ 

xGL {xi,X2)&LixL2 

The discriminant of b is det(i?), where B is the matrix of b with respect 
to some basis of L (indeed, this determinant does not depend on the choice 
of basis); we denote it by discr(6). 

We define the positive integer Nl to be the exponent of the cokemel of 
the map cf)},: L ^ given by b, or, equivalently, to be the denominator 
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of B~^, where B is the matrix of b with respect to some basis e of L. The 
map Nl(()^^ : Lq ^ Lq restricts to a map N^cj)'^^ : L. Viewing L 

as {Li^y in the usual way, this gives a positive definite symmetric bilinear 
form 6' : X — > Z. The matrix of this form with respect to the ba- 
sis dual to e is NlB~^. Applying this same construction to h' gives a 
b" : L X L ^ Z that is not necessarily equal to b: one has b = mb", with 
m G Z>o and b" primitive (i.e., the Z-Iinear map L ^ Z induced by b" 
is surjective). Poisson's summation formula gives the following functional 
equation; see [Ser5, Vll, §6, Prop. 16]. 

2.3.4 Theorem Let L be a free Z-module, of finite rank n, equipped with a 
positive definite symmetric bilinear form b: L x L Z. We have, with the 
notation as above, for all z G H; 

where the square root of—N^iz is holomorphic in z and positive for z G Ri. 

The form b is called even ifb{x, x) is even for all x in L. Equivalently, b 
is even if and only if the matrix B of b with respect to some basis of L has 
only even numbers on the diagonal. 

The form b is called unimodular if : L — )• is an isomorphism, or, 
equivalently, if = 1. In this case, (f)\, is an isomorphism from (L, b) to 
{L\b'). 

With this terminology, one has the following result, see [Miy, Cor. 4.9.5], 
the proof of which has as main ingredient the functional equation of Theo- 
rem 2.3.4. 

2.3.5 Theorem Let L be a free Z-module of finite rank n, equipped with a 
positive definite synametric bilinear form b: L x L ^ Z. Assume that n is 
even. Let Nl be as defined above, and let xl be the character given by: 

XL-. (Z/iV^Z)x ^ C^ (a mod Nl) ^ ^tll!!^^^^ , 

where the fraction denotes the Kronecker symbol. 

1. The function z Ol{^z) is a (non-cuspidal) modular form on 
ri(4Ar^) of weight n/2 and with character xl- 
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2. If b is even then the function 6i is a modular form on Ti{2Ni) of 
weight n/2 and with character xl- 

3. If both b and b' (see above for its definition) are even, then the function 
6 Lis a modular form on F i [N^ ) of weight n/2 and with character xl ■ 

This theorem says nothing about the case where n is odd. In that case, is 
a modular form of half-integral weight n/2; see [Miy, Cor. 4.9.7]. For even 
unimodular forms, we have the following corollary of Theorem 2.3.5. 

2.3.6 Corollary Let L be a free X-module of finite rank n, and let 

b: L X L ^ Z be bilinear, symmetric, positive definite, even and unimodu- 
lar. Then n is even, and 6l is a modular form on SL2(Z) of weight n/2. 

Proof As b is unimodular, we have Nl = 1. The fact that n is even follows 
from the fact that b induces a non-degenerate alternating bihnear form on 
F2 (8) L. As (^b : L — > is an isomorphism between (L, b) and {L^ ,b'), 
we have that b' is even as well. Theorem 2.3.5 gives the conclusion. □ 

2.3.7 Remark In fact, the rank of an even unimodular lattice is a multi- 
ple of 8. This follows directly from Theorems 2.3.4 and 2.3.5 (see [Miy, 
Cor. 4.9.6], or [Ser5, Vll, §6, Thm. 8]). 

Let us consider some examples. 

2.3.8 Example For n G Z>o we consider Z" with its standard inner prod- 
uct. For m in Z we have: 

= #{x G I X? -I h = m}, 

the number of ways in which m can be written as a sum of n squares of inte- 
gers. Theorem 2.3.5 tells us that for even n the theta function z Oz^ {2z) 
is a modular form on ri(4) of weight n/2. According to (2.3.3) we have 
9zn = and so all the functions z i-> O^n (2z) are powers of the modular 
fom ^^^^ q""^ of weight 1/2 on ri(4). 
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2.3.9 Example We consider the E8-lattice, i.e., E8 := equipped with 
the inner product given by the Dynkin diagram £'8 with numbered vertices: 

1 2 3 5 6 7 8 



that is, whose matrix with respect to the standard basis is: 



/2 
-1 



-1 
2 

-1 



-1 
2 

-1 
-1 



-1 
2 



-1 



-1 
2 

-1 



V 



-1 
2 

-1 



The lattice E8 is unimodular and even, hence, by Corollary 2.3.6, 9e8 
is a modular form on SL2(Z) of weight 4, i.e., 6e8 is an element 
of M4(SL2(Z)). The dimension space of M4(SL2(Z)) is one, with the 
Eisenstein series E4 = 1 + 240"^^^^ as{n)q"- as basis. Therefore, 6e8 
is a constant times E4. Comparing constant terms, we get: 



^E8 = ^4 = l + 240^c73(n)g". 



n>l 

2.3.10 Example Let L be the Leech lattice. This lattice, which is of 
rank 24, even and unimodular, is named after John Leech, see [Lee2] 
and [Leel]. Apparently, it had already been discovered by Ernst Witt in 
1940 (unpubUshed, see [Wit]). John Horton Conway showed in [Conw] 

that L is the only non-zero even unimodular lattice of rank less than 32 with 
rL{2) = 0; this also follows from Hans-Volker Niemeier's classification of 
even unimodular lattices of rank 24 in [Nie]. According to Henry Cohn and 
Abhinav Kumar [Co-Ku], the Leech lattice gives the densest lattice sphere 
packing in dimension 24. 

Theorem 2.3.5 above shows that the theta function Ql of the Leech lattice 
is a modular form of level 1 and weight 12. The space of such modular 
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forms is two-dimensional, with basis the Eisenstein series E12 and the dis- 
criminant form A, where: 



Hence 0l is a linear combination of £^12 and A. Comparing the coefficients 
of q"^ for m = and m = 1 gives: 



2.4 GALOIS REPRESENTATIONS ATTACHED TO EIGENFORMS 

The aim of this section is to describe the construction of the Galois rep- 
resentations attached to modular forms, that came up in the case of A in 
Section 1.5. Before giving the construction, let us state the result, which is 
due, for A; = 2, to Eichler and Shimura [Shil], to Deligne [Dell] for k > 2, 
and to DeUgne and Serre [De-Se] for k = I. See Section 12.5 in [Di-lm]. 
A long account of the construction in the case k > 2 will be given in the 
book [Conr]. 

2.4.1 Theorem Let / be a normalised newform, let n be its level, let k be its 
weight, and let £ : (Z/nZ)^ be its character. Then the subGeld K of 

C generated over Q by the an{f), n> 1, and the image of e is finite overQ. 
For every prime number I and for any embedding \ of K into Qi, there is 
a continuous two-dimensional representation Vx overQi of Gal(Q/Q) that 
is unramihed outside nl and such that for each prime number p not dividing 
nl the characteristic polynomial of the Frobenius at p acting on V\ equals: 

det(l - a;Frobp, V^) = 1 - ap{f)x + e(p)/-^x^. 

For k > 2 the representations Vx can be found in the /-adic etale coho- 
mology in degree — 1 of some variety of dimension A; — 1, or in the 
cohomology in degree one of some sheaf on a curve, as we will describe 
below. The determinant of the action of Gal(Q/Q) on Vx is easily de- 
scribed. We let xi- Gal(Q/Q) — ^ be the Z-adic cyclotomic charac- 
ter defined by a{z) = z^'^^), for all a in Gal(Q/Q) and all z in q"" 
of Z-power order. We let e: Gal(Q/Q) be the composition of 
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the character e: {'L/n'L)^ — with the mod n cyclotomic character 
Gal(Q/Q) ^ (Z/nZ)^ given by the action of Gal(Q/Q) on /i„(Q). With 
these definitions, the determinant of the action of Gal(Q/Q) on Vx is given 
by the character £xf~^. As the image of Gal(Q/Q) under the determinant 
of V\ is infinite, its image in GL(Va) is infinite. 

On the other hand, for k = 1, the image of Gal(Q/Q) in GL(yx) is fi- 
nite, and in fact all these representations when A varies can be realised over 
some fixed finite extension of Q. The proof of Theorem 2.4.1 by Deligne 
and Serre in the case = 1 is quite different from the case A: > 2: the 
reductions to finite coefficient fields (see Section 2.5) can be constructed 
via congruences to forms of weight 2, and then it is shown that these repre- 
sentations can be Ufted to characteristic zero. No direct construction of the 
characteristic zero Galois representations for forms of weight one is known. 
We remark that in the case k = 2 the V\ occur in the first degree etale co- 
homology with constant coefficients Q; of modular curves, hence can be 
constructed from /-power torsion points of Jacobians of modular curves (in 
fact, of the modular curve Xi{n)). 

The representation Vx is irreducible by a theorem of Ribet, see Theo- 
rem 2.3 of [Rib2], and hence it is characterised by its trace. As the Frobenius 
conjugacy classes at the primes not dividing nl are dense by Chebotarev's 
theorem, the representation is unique up to isomorphism. Non-cuspidal 
eigenforms lead to Galois representations that are reducible; as our interest 
lies in going beyond class field theory, we do not discuss this case. 

Let us now start the description of the construction, by Deligne, of the 
representation Vx as in Theorem 2.4. 1 above in the case where k>2. First, 
if n < 5, we replace n by say 5n and / by a normalised Hecke eigenform in 
the 2-dimensional C-vector space generated by f{q) and f{q^). Then / is 
no longer a newform, but it is an eigenform, which will be good enough, and 
as n > 5 we can view it as a section of the line bundle t<j®'^'(— Cusps) on the 
smooth complex projective curve Xi{n). The eigenvalues at primes other 
than 5 have not been changed by this operation. As one can compute from 
the formulas in the previous section, the two possible eigenvalues for T5 on 
the space generated by f{q) and f{q^) are the two roots of the polynomial 

— cL^{f)x + £(5)5^^"^, i.e., the two eigenvalues of the Frobenius element 
at 5 attached to / if A does not divide 5. For a detailed computation for this. 
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see Section 4 of [Co-Ed] ; that article also explains why one should expect 
the two eigenvalues always to be distinct, and that this is a theorem if = 2. 

On Yi{n), we have a universal family (E/Yi{n),F) of elliptic curves 
with a given point of order n. Taking fibre- wise the cohomology H^(Es, Z) 
gives us a locally constant sheaf on Yi{n), denoted R^p*Ze because it is 
the first higher direct image of the constant sheaf Ze on E via the morphism 
p: E — > Yi{n). The stalks of the locally constant sheaf R^p^Z^ on Yi{n) 
are free Z-modules of rank 2. More concretely, the sheaf R^p*Ze is ob- 
tained from the constant sheaf on H by dividing out the ri(n)-action 
given by: 

^ ) ^ ^ (m) ' ) (m) ' ^ ) ( (cn + dm) ' cr + ' 

where 7 = ^). 

We will also use other locally constant sheaves on Yi (n) that are obtained 
from R^p*Ze by tensor constructions. The classification of the irreducible 
representations of the algebraic group GL2 over Q imphes that these ten- 
sor constructions are finite direct sums in which each term is a symmetric 
power of R^p*Ze, tensored with a power of the determinant of R^p^Zg. We 
define: 

(2.4.3) •■= Sym^-2(RVZE), 

where Sym*^"^ denotes the operation of taking the {k — 2)th symmetric 
power. The sheaf Tk is then obtained by dividing out the ri(n)-action 

on the constant sheaf Sym^~^(Z^) on H. It is useful to view I? as 
the Z-submodule Zx © Zy of the polynomial ring Z[x,y]. The grading 
Z[x, y] = ©jZ[x, y]i by the degree then gives the symmetric powers of 

Zx © Zy: 

(2.4.4) Sym^-2(z2) = Z[x,y]fc_2= Z^y. 

i+j=k-2 

We extend the sheaf Tj. to Xi{n) by taking the direct image via the open 
immersion j: Yi{n) — > Xi{n); this gives us j*J^fc on Xi{n), again de- 
noted Tk- Outside the cusps, J^k is locally constant, with stalks free of rank 
k — 1 as Z-modules. At the cusps, the stalks of Tk are free of rank one. 
At the cusp 00 this follows from the fact that the subring of invariants of 
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Z[a;, 7/] for the action of ( J J ) is At the other cusps it then follows by 
conjugating with a suitable element of SL2(Z). We note that for = 2 the 
sheaf is the constant sheaf Z on Xi (n). 

The Eichler-Shimura isomorphism gives a relation between modular 
forms and the cohomology of Tk- One way to view this, due to Deligne, 
is in terms of Hodge structures. More precisely, the C-vector space 
C (8) {Xi (n) , J^h) carries a Hodge decomposition: 

(2.4.5) C^}i\Xi{n),Tk) ^ Sfc(ri(n)) Sfc(ri(n)), 

where the two terms on the right are of type {k—1,0) and (0, k — 1), respec- 
tively. The complex conjugation on the second term on the right comes from 
the complex conjugation on the tensor factor C on the left. A good reference 
for this decomposition and its properties is [Ba-Ne]; we will not go into de- 
tails here. For an account using group cohomology we refer to Section 12.2 
of [Di-lm]. For A; = 2 all of this is quite easy. Via the Kodaira-Spencer 
isomorphism (2.2.20) it then is the decomposition: 

(2.4.6) Hi(Xi(n),C) = H°(Xi(n), Q^) HO(X^(^^pP0- 

We should mention that instead of working with the sheaf Tk on the curve 
Xi (n), one can also work with a constant sheaf on a A; — 1-dimensional va- 
riety. As before, we let (E, P) denote the universal object over Yi{n). Then 
we let E*^"^ denote the k — 2-fold fibre power of E over Yi (n); these are the 
simplest cases of so-called Kuga-Sato varieties. The graded commutative 
algebra structure on cohomology gives, for s in Yi{n), a map, equivariant 
for the action of the symmetric group Sk-2- 

Z(£) ® R^{Es, Z) • • • H^(Es, Z) — > H'=-2(E^-2, Z), 

where Z{e) denotes the sign representation. Twisting this map by Z{e) and 
taking co-invariants gives a map: 

(2.4.7) Tk,s = Sym*^-2(Hi(E„ Z)) U'^'^iE'^-^ Z)„ 

where the subscript £ means the largest quotient on which Sk-2 acts via 
the sign representation. In view of the Leray spectral sequence for the co- 
homology H(E'^~^, Z) of E'^"^ in terms of the cohomology of the higher 
derived direct images H(Yi(n), Rp*Z]|;fc-2) it is then not so surprising that 
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Sk{Ti{n)) can be identified with a piece of}i'^^^{E''^'^, C), where E^^-^ 
a certain smooth projective model of E^'~^ over Xi{n). Some details for 
this can be found in [Dell], and more of them in [Schl], and probably still 
more in [Conr]. A very exphcit way to describe this identification is the 
map: 



where r is the coordinate on H, and the Zj are the coordinates on the copies 
of C using Et- = C/ (Zr + Z). It is indeed easy to verify that the differential 
form on the right is invariant under the actions of and SL2 (Z), pre- 

cisely because / is a modular form of weight A; for Fi (n) . The claim (proved 
in the references above) is that it extends without poles over E'^"^. As it is 
a holomorphic form of top-degree, it is automatically closed, and hence de- 
fines a class in the de Rham cohomology of E*^"^, hence in H'^~^(E^~2^ 

There are natural Hecke correspondences on C H^(Xi(n), J^^) and 
on H'^~^(E'^'^^, C), and the identification of Sk(Ti{n)) as a piece of these 
cohomology groups is compatible with these correspondences. Let now 
/ be our eigenform in S'fc(ri(n)) as above. Then the Hecke eigenspace in 
C (g) [Xi (n) , Fk) with the eigenvalues ajn{f) for is two-dimensional: 
the sum of the one-dimensional subspace C/ in Sk{ri{n)) and the one- 
dimensional subspace Cf in 5fc(ri(n)), where /' = 5^^>i am{f)'f^, the 
Galois conjugate of / obtained by letting complex conjugation act on the 
coefficients of /. This element /' has eigenvalue am{f) for T^, hence 
/' has eigenvalue am{f ) again. The {k — l)-form corresponding to /' is 
f'df dzi ■ ■ ■ dzk-2, indeed a form of type (0, A; — 1). 

We let T(n, k) or just T denote the Z-algebra in Endc(5'fe(ri(n))) gen- 
erated by the (m > 1) and the (a) (a in (Z/nZ)^). The fact that 
the Eichler-Shimura isomorphism (2.4.5) is equivariant for the Hecke cor- 
respondences acting on both sides implies that the image of {Xi (n) , Tj.) 
in C (X" {Xi (n) , Tk) is a faithful T(n, A;)-module. As this image is free of 
finite rank as Z-module, T(n, k) is free of finite rank as Z-module. 

Let us for a moment drop the assumption that n > 5. For A a sub- 
ring of C and for n > 1, we let Mk{Ti{n),A) be the sub-^-module of 
Mk{Ti{n)) consisting of elements g such that am{g) € A for all m > 0. 



(2.4.8) 



Hfc-i(E*^-2^C) 



f ^(2'Kif-^fdTdzi---dZk-2 
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In particular, Mfc(ri(n),Z) is the submodule of forms whose g'-expansion 
has all its coefficients in Z. Similarly, for A a subring of C and for n > 1, 
we let Sk(Ti{n), A) be the sub-A-module of Sk(Ti{n)) consisting of ele- 
ments g such that am{g) € A for all m > 1. For example, A belongs to 
S'i2(SL2(Z),Z). The S'jk(ri(n), ^) are T(n, A;)-submodules of S'fc(ri(n)); 
see Propositions 12.3.11 and 12.4.1 of [Di-lm]. 
We have the following pairing between T(n, k) and S'fe(ri(n), Z): 

(2.4.9) 5fe(ri(n),Z) X T{n,k) Z, {g,t) ^ ai{tg). 

This pairing is perfect, in the sense that it identifies each side with the Z- 
hnear dual of the other; this follows easily from the identity (2.2.12). It 
follows that the Z-dual S'fe(ri(n),Z)^ of S'fe(ri(n),Z) is free of rank one 
as T(n, A;)-module. See [Di-Im, 12.4.13]. 

For any Z-algebra A we let = T(n, k)A denote A ir(n, k), and 
will denote the ^-linear dual of T^. It can be proved that Tq, is free 
of rank one as TQ-module, i.e., that Tq is Gorenstein. One proof is by ex- 
plicit computation, see Theorem 3.5 and Corollary 3.6 of [Par]. Another, 
more conceptual proof, uses the Petersson inner product, and a so-called 
Atkin-Lehner pseudo-involution W(^^, to show that S'fc(ri(n))^ is isomor- 
phic as Tc-module to Sk{T\{n)) itself; see [Di-Im, 12.4.14]. It follows 
that 5fe(ri(n)) is free of rank one as Tc-module, and, if n > 5, that 
Q ® YV-{Xi{n),Tk) and its dual Q Hi(Xi(n), are free of rank 
two as TQ-module. It is this freeness result that will lead to the fact that the 
Galois representations we get are two-dimensional. 

We assume again that ra > 5. The step from the cohomological interpre- 
tation of modular forms, given, over the complex numbers, by the Eichler- 
Shimura isomorphism (2.4.5), to two-dimensional Z-adic Galois represen- 
tations is made by comparing the cohomology groups above to their Z-adic 
counterparts for the etale topology, and noting that p: E — > Xi{n) is natu- 
rally defined over Z[l/n] as we have seen at the end of Section 2.1. From 
now on we will denote by Xi{n) this model over Z[l/n], and by Xi(n)(C) 
the Riemann surface given by Xi{n). For any Z[l/n] -algebra A, Xi{n)A 
will denote the ^-scheme obtained from Xi{n) by extending scalars via 
Z[l/n] ^ A. 
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We let Fk^i denote the sheaf of Qi-vector spaces Q/® Jtc on Xi{n). Then 
we have a canonical isomorphism: 

(2.4.10) H\Xi(n)(C), = ® ^\X^{n){C) , Tk) . 

The sheaves Fk^i can also be constructed on the etale site Xi(n)et, by tak- 
ing the first derived direct image of the constant sheaf Q; on Eet under 
p: E — > li(n), then the {k — 2)th symmetric power of that and finally 
the pushforward from Y\{n) to Xi{n). 

The usual comparison theorems (comparing cohomology for etale and 
Archimedean topology, and etale cohomology over various algebraically 
closed fields) give: 

Hi(Xi(n)(C),J^jk,0 = Hi(Xi(n)c,et, Ai) 
= Hi(Xi(n)Q^,,,J-fe,0. 

(2.4.12) Wi:=^\X^{n)^^^^,Fk,iY. 

By the results and the comparisons above, Wi is, as Tq^ -module, free of 
rank 2, and Gal(Q/Q) acts continuously on it. To be precise: an element 
a of Gal(Q/Q) acts as ((id x Spec((7~^))*)^, which is indeed covariant 
in a. The fact that the Hecke correspondences exist over Q makes that the 
Gal(Q/Q)-action on Wi commutes with the Hecke operators. The choice 
of a -basis of Wi gives us a representation: 

(2.4.13) pi : Gal(Q/Q) GL2(TqJ. 

Recall that we have fixed an eigenform / in Sk{Ti{n), C). Sending a Hecke 
operator to its eigenvalue for / then gives us a morphism of rings: 

(2.4.14) (f)f:T — >C. 

We let K{f) be the image of Tq under (pj; it is the finite extension of 
Q obtained by adjoining all coefficients am(/) of the (^-expansion of /. We 
now view as a morphism from T to K{f). The tensor product Qi'SiK{f) 
is the product of the completions K{f)x, with A ranging through the finite 



(2.4.11) 
We put: 
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places of K{f) that divide For each such A we then get a morphism 
^/,A • '^Qi ^ K{f)\, and a representation: 

(2.4.15) pfx- Gal(Q/Q) ^ GL2(if(/)A). 

These are the representations mentioned in Theorem 2.4.1. It may be useful 
to note that the space on which the representation is realised is: 

(2.4.16) Vf,x:=K{f)x®T^Wi. 

The representations pf^x are continuous by construction. The sheaves Fk,i 
on Xi{n)iyiini] are "lisse" away from the cusps, and tamely ramified at the 
cusps, hence, by Proposition 2.1.9 of [SGA7, Xlll, §2], pf^\ is unramified 
at all p not dividing nl. 

In the case where k = 2 the construction of the pf^x is much simpler, 
because then the sheaf Tk is the constant sheaf Z on Xi(n)(C). The use 
of etale cohomology can then be replaced by Tate modules of the Jacobian 
variety of Xi{n). We let J := Ji(n) be this Jacobian variety, actually an 
Abelian scheme over Z[l/n]. Then we have: 

(2.4.17) Wi=Q0llmJ{Q)[r]. 

m 

The fact that for p a prime not dividing nl the characteristic polynomial of 
Pf^x(P^ohp) is as stated in Theorem 2.4.1 is obtained by studying the reduc- 
tion modulo p of the Hecke correspondence Tp, i.e., as a correspondence 
on Xi{nl)f^, compatibly with the sheaf Tk^i- For details we refer to Con- 
rad's book [Conr] and Deligne's article [Dell]. In the case k = 2 this result 
is known as the Eichler-Shimura congruence relation, expressing the endo- 
morphism Tp of Jf^ as F+{p)V, where F denotes the Frobenius endomor- 
phism, and V its dual, i.e, the endomorphism satisfying FV = p = VF in 
End( Jpp). For details in the case = 2 we refer to Section 12.5 of [Di-Im]. 

Now that we have sketched the construction of the /-adic Galois repre- 
sentations attached to modular forms, we mention some more of their prop- 
erties, that are not mentioned in Theorem 2.4. 1 and in the remarks directly 
following that theorem. 

The fact that Deligne proved the Riemann hypothesis part of Weil's 
conjectures in [Del2] imphes very precise bounds on the coefficients of 
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modular forms. The reason for that is that the roots of the equation 
x'^ — ap{f)x + e f {p)p^~^ are eigenvalues of the Frobenius at p on the space 
H'^^^(E'=~2_ state these bounds, called Ramanujan bounds, in 

a theorem, due to DeUgne in the case k >2, and to DeUgne-Serre ([De-Se]) 
in the case k = 1. 



2,4.18 Theorem Let f be a normalised newform, let n be its level and k its 
weight. Then for p not dividing n, we have: 

(2.4.19) |ap(/)| < 2-p^^-^y\ 

A slightly weaker result than in the theorem above, stating that, for a given 
/ as above, \am{f)\ = 0(m'^/^), can be obtained in a very elementary way; 
see [Miy, Cor. 2.1.6] (the idea is to use that the function z i-> \ f{z)\{^{z))^ 
is bounded on H and to view am{f) as a residue). 

Theorem 2.4.1 gives us information on the restriction Pf^x^p of pf^x to 
decomposition groups Gal(Qp/Qp) for p not dividing nl. Namely, the the- 
orem says that such restrictions Pf,x,p are unramified, and it gives the eigen- 
values of pf x,p(PTohp). Unfortunately, it is not known if ,\ p(Frobp) is 
semi-simple; see [Co-Ed] for information on this. 

We should note that also in the case that p divides nl almost everything 
is known about Pf,x,p- For p not dividing I, this is the very general state- 
ment that the "Frobenius semi-simpUfication" of Pf,x,p corresponds, via a 
suitably normahsed local Langlands correspondence, to a certain represen- 
tation TTf^p of GL2(Qp) attached to /. This result is due, in increasing order 
of generality, to Langlands, Deligne, and Carayol. For details on this the 
reader is referred to [Car], which gives this result in the more general con- 
text of Hilbert modular forms (i.e., Q is replaced by a totally real number 
field). The result for p = Z uses Fontaine's p-adic Hodge theory, and is due 
to Saito ([Sail] for the case of modular forms, and [Sai2] for the case of 
Hilbert modular forms). 
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2.5 GALOIS REPRESENTATIONS OVER FINITE FIELDS, AND REDUC- 
TION TO TORSION IN JACOBIANS 

We start this section by explaining how to pass from Z-adic Galois represen- 
tations to Galois representations over finite fields. 

Let f = c-mff^ be a (complex) normalised cuspidal eigenform for all 
Hecke operators T^, m > 1, of some level n > 1 and of some weight 
fc > 2. As in Theorem 2.4.1 we have the Galois representations pf^\, from 
Gal(Q/Q) to GL2(Qi). It follows from the construction of those represen- 
tations that there is a finite subextension Qi^EofQi^ Qi such that pf^x 
takes its values in GL2(-E'). (Actually, this can also be deduced from the 
continuity alone; see the proof of Corollary 5 in [Did] for an argument.) 
The question as to what the smallest possible E is can be easily answered. 
Such an E must contain the traces ap( f ) of the pf xiF^ohp) for all p not di- 
viding nl. So let K be the extension of Q generated by the ap{f) with p not 
dividing n, i.e., K is the field of definition of the newform corresponding 
to /. Then E can be taken to be Kx, the Z-adic completion of K specified 
by the embedding Xof K into (see Section 12.5 in [Di-Im]). 

Let now pf^x- Gal(Q/Q) — > GL2(-E') be a realisation of pf^x over E 
as above. As pf^x is semisimple (it is even irreducible), such a realisa- 
tion is unique up to isomorphism (because it is determined by the traces). 
Let O^; be the ring of integers in E, i.e., the integral closure of Zi in E. 
As Gal(Q/Q) is compact, it stabilises some Oe lattice in E'^ (in the set 
of lattices, the orbits under Gal(Q/Q) are finite, take the intersection, or 
the sum, of the lattices in one orbit). This means that, after suitable con- 
jugation (choose such a lattice, and an Og-basis of it), pf^x takes values 
in GL2(0£;). We let Oe denote the morphism induced by the given 

embedding of E into Qi (we view F/ as the residue field of the subring 
of integers Z/ of Q^). We can then define the residual Galois represen- 
tation Jif x to be the semi-simplification of the composed representation 
Gal(Q/Q) GL2(Oe) GLaCF,). Another choice of E or of lattice 
or basis leads to an isomorphic Pj^X' but we note that without the operation 
of semi-simplification this would not be true (see Chapter in of [Ser7]). 

Given /, all but finitely many of the Jjj are irreducible. This was proved 
for / of level one and with coefficients in Z in Theorem 4 of [Swi]. The 
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general case follows easily from Theorem 2.3 of [Fa- Jo], which says that 
if 'pf x is reducible with I > k not dividing n, then 'pf x = " © /^xf ~^ 
with a and ^ unramified outside n, and Xi '■ Gal(Q/Q) — )• F^^ the mod I 
cyclotomic character. Moreover, the proof shows that the set of I such that 
some pfx is reducible can be bounded explicitly. 

The next question that we want to answer is the following: what is the 
smallest subfield of over which 'p-^ x can be realised? Just as for pf^x 
itself, that subfield must contain the traces of the pj ;^(Frobp) for all p not 
dividing nl. That condition turns out to be sufficient, as we will now show. 
So we let, in this paragraph, F be the subfield of F; that is generated by the 
images ap{f) in F; of the ap{f) in Z;. Then for any a in Gdl{¥i/¥) the 
conjugate ^ ofp^x and pf x itself are both semisimple and give the same 
characteristic polynomials as functions on Gal(Q/Q). Therefore, by a the- 
orem of Brauer-Nesbitt (see Theorem 30.16 of [Cu-Re]), Jif x is isomorphic 
to all its conjugates over F. (A more general statement of this kind is given 
in Exercise 1 of Section 18.2 of [Ser7].) The fact that Gal(F//F) is equal to 
Z then implies that pj x can be realised over F. Let us give an argument for 
that in terms of matrices, although a much more conceptual argument would 
be to say that a "gerbe over a finite field is trivial". Let a be the Frobenius 
element of Gal(F;/F), and let s be an element of GL2(F;) such that for all 
g in the image of pj- x we have a{g) = sgs~^. Then take a t in GL2(F/) 
such that .s = a{ty^t. Then all tgt~^ are in GL2(F). By Brauer-Nesbitt, 
the realisation over F is unique. 

For a discussion on possible images of pjx we refer the reader to the in- 
troduction of [Ki-Ve] (we note however that for / a "CM-form", i.e., a form 
for which all Z-adic Galois representations have dihedral image) infinitely 
many of the p^ x can have dihedral image in PGL2(Fj)). In particular. The- 
orem 2.1 of [Rib3] states that for / not a CM-form only finitely many of 
the images of the 'p-^ x are exceptional in the sense that they are of order 
prime to /. See also Theorem 2.5.18 for the case where n = 1. For / > 3 
such that pf x is irreducible and not exceptional, a result of Dickson, see 
Chapter Xn of [Dic2], or the proof of Theorem 2.5 of [Rib4], says that the 
image of pf x in PGL2(F/) is, after suitable conjugation, equal to PGL2(F) 
or SL2(F)/{1, —1} for some finite extension F of F;. We note that this 
field F can be smaller than the extension F; generated by the traces of pf x 
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(indeed, twisting does not change the projective image, but it can make the 
field generated by the traces bigger). 

We will use later on the following lemma. 

2.5.1 Lemma Let I be a prime number, let V be a two-dimensional F/- 
vector space, and let G be a subgroup of Aut(F) of order a multiple of I, 
and such that V is irreducible as a representation of G. Then G contains 
SL(y), and acts transitively onV — {0}. 

Proof Let gi be an element of G of order I. Then the kernel Li of 51 — idy 
is a Une. As V is irreducible, Li is not G-invariant, hence we can take an 
element h in G such that L2 := hLi is not Li. Then ^2 '■= hgih~^ is of 
order I and fixes L2. Let ei and 62 be non-zero elements of Li and L2, 
respectively. Then with respect to the basis e = (ei, 62) of V, gi and g2 
are given by elementary matrices of the form (of) and Hi), respectively, 
with a and b non-zero, and hence generate SL(V"). □ 

It follows that if p^x takes values in GL2(F;), and is irreducible and not 

exceptional, then impj ;^ contains SL2(F;), and therefore is the subgroup 
of elements of GL2(Fi) whose determinant is in the image of the charac- 
ter 'ej-x'l^^- In that case, imp;^ acts transitively on F^ — {0}. 

The properties of residual Galois representations that we have seen above 
show that we do not need to define them via Z-adic Galois representations, 
but that we can start from maximal ideals in Hecke algebras. 

2.5.2 Theorem Let n and k be positive integers. LetF be a finite held, and 
f : T(n, /c) — > F a surjective morphism of rings. Then there is a continuous 
semi-simple representation: 

Pf. Gal(Q/Q) ^ GL2(F) 

that is unramihed outside nl, where I is the characteristic of F, such that for 
all p not dividing nl we have, in F: 

trace(p(FVobp)) = f{Tp) and det(p(Frobp)) = /((p))/-^ 

Such a Pf is unique up to isomorphism (i.e., up to conjugation). 
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Proof Let n, k, ¥ and / be given. As T := T{n, k) is free of finite rank as 
Z-module, Spec(T) has only finitely many irreducible components, each of 
which is one-dimensional and finite over Spec(Z). Therefore, the maximal 
ideal ker(/) of is the speciahsation of a maximal ideal m of Tq. Let 
K be the quotient Tq/tw. Then the quotient morphism Tq — )• K is a nor- 
maUsed eigenform / in Sk{yi{n))K, and p/ is the realisation over F of the 
reduction of some ^ □ 



Let now / be as in Theorem 2.5.2, and let us suppose now that p/ is irre- 
ducible. The construction of ^-adic Galois representations that we recalled 
in Section 2.4 implies that the dual of p/ occurs in as 
well as in li^{Xi{n)-^^^,Fk,i), where Tk,i is defined as Tk,i but with 
replaced by F^. Let us now assume that k > 2. Then both these realisa- 
tions are difficult to deal with computationally. In the first representation 
the difficulty arises from the degree k — \ etale cohomology; it seems to be 
unknown how to deal explicitly with elements of such cohomology groups. 
In the second representation, the elements of the cohomology group are 
isomorphism classes of J-'fc^;-torsors, on Xi{n)-^ Such torsors can be de- 
scribed explicitly, as certain covers of Xi (n)^ with certain extra data. The 
set of such torsors can probably be described by a system of polynomial 
equations that can be written down in time polynomial in nl (think of the 
variables as coefficients of certain equations for the torsors). But the prob- 
lem is that, apparently, there are no good methods known to solve these 
systems of equations (the number of variables grows too fast with I and 
the equations are not linear). In fact, the satisfiability problem SAT, which 
is known to be NP-complete (Cook's theorem, see for example [Mori], or 
wikipedia), is a special case of the problem of deciding whether or not a 
polynomial system of equations over F2 has a solution over F2. We note 
that the description of the set of torsors by a system of polynomial equa- 
tions should also work over suitable finite extensions of finite fields Fp, in 
time polynomial in / log p. 

Another place where p/ occurs is in Ji(n/)(Q)[^], i.e., in the /-torsion of 
the Jacobian of the modular curve with level nl,iil + l>k and I J(n. This 
means that at the cost of increasing the level by a factor I, we are reduced 
to deahng with torsion points on Abehan varieties. Of course, the Z-adic 
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representations ^ attached to lifts of / do not occur in the Jacobian of 
any curve, simply because the Frobenius eigenvalues are Weil numbers of 
the wrong weight. What happens here for is a "mod I phenomenon" 
having to do with "congruences" between modular forms. Before we give a 
detailed statement, let us explain why this happens (such explanations date 
back at least to the 1960's; Shimura, Igusa, Serre,. . . ). 

For simplicity, and only during this explanation, we assume that n > 5. 
Then we have a universal elliptic curve with a given point of order n over 
Z[l/n^] -schemes: (E/Yi(n),P). Weletp: E H> Yi{n) denote the structure 
morphism. By definition, we have: 

(2.5.3) Tk,l = Sym''-''R^p,¥i. 

As explained at the end of Section 1.3, we have a natural isomorphism: 

(2.5.4) RV*Fi=E[/]^. 

And by the definition of Yi{nl), and the Weil pairing, we have an exact 
sequence on Yi{nl)et'- 

(2.5.5) O^Fi^ K[l] ^i^i^O, 

where ¥i and /i/ denote the corresponding constant sheaves. It follows that 
the puUback of R^p^Wi to Yi{nl)ct has a 2-step filtration with successive 
quotients F; and /x^. Therefore, Tk,l has a filtration in A; — 1 steps, with 
successive quotients Ff ' (g) (/x)^)®-' = nf~K with i + j = k - 2, i > 0, 
J > 0. In particular, we get a map: 



(2.5.6) 



This map explains that pf is likely to occur in Ji (n?) (Q) [/] . A better way 
to analyse this map is in fact by studying the direct image of the constant 
sheaf F; via the map Xi{nl) — Xi{n). A recent detailed treatment of this 
method, and precise results can be found in [Wiel]. 

Another way to show that pf occurs in Ji{nl){Q)[l] is to study modular 
forms mod I of level nl and of weight 2. This is more complicated than the 
modular forms that we have seen before, as it uses the study of the reduction 
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mod I of the modular curve Xi{nl), which is not smooth. The study of 
these reductions has its roots in Kronecker's congruence relation. The most 
complete modem accounts of such material are given in the article [De-Ra] 
by DeUgne and Rapoport and in the book [Ka-Ma] by Katz and Mazur. A 
construction of in Ji{nl){Q)[l], following suggestions from Serre, was 
given by Gross in [Gro]. 

We are now in a position to state the following theorem, that, combining 
Gross's result with a so-called multiplicity one theorem, gives us a useful 
realisation of pf. As it is nowadays customary to say, it is a result due to 
"many people" (mainly Mazur, Ribet, Gross (and Edixhoven for the multi- 
pUcity one part)). 

2.5.7 Theorem Let n and k he positive integers, F a finite field and I its 

characteristic, and f: T{n,k) -> F a surjective ring morpliism. Assume 
that 2 < k < l+l and that the associated Galois representation pj from 
Gal(Q/Q) to GL2(F) is absolutely irreducible. Then there is a unique ring 
morphism /s : T{nl, 2) ^ F such that for alii > 1 one has f2{Ti) = f{Ti). 
Themorphism /2 is surjective. Letruf = ker(/2), and let Vf C Ji(nZ)(Q) 
denote the kernel ofruf, i.e., the ¥-vector space of elements x in J\ (nl) (Q) 
such that tx = for all t in mj. Then Vj is a finite, non-zero, direct sum 
of copies of Pf. If k < I then the multiplicity of pf in Vj is one, i.e., Vf 
realises pf. For all a G (Z/n/Z)^, one has /2((a)) = f{{a))a^~'^, where 
we still denote by a its images in 'LjnL and in F;. 

Proof The existence of ji and the statement that V/ is a successive ex- 
tenstion of copies of p/ are given in [Gro] (see his Proposition 11.8). In 
Section 6 of [Edil] it is proved, applying results from [Bo-Le-Ri], that V/ 
is a direct sum of copies of p/. Case 1 of Theorem 9.2 of [Edil] gives the 
multiplicity one result. □ 

2.5.8 Remark See [Wie2], Corollary 4.5, for a complete result on the mul- 
tipUcity one question for weights k with 2 < A; < Z+l. In particular, \ik = l 
and p/ is unramified at I and p/(Frob;) is scalar, then this multiplicity is not 
one. 

As we want to describe Vj explicitly, we will need a bound on the amount 
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of Hecke operators needed to describe T{nl, 2) and its ideal ruf. We start 
by quoting a result of Jacob Sturm (see [Stu]). 

2.5.9 Theorem (Sturm) Let N >1 bean integer, T a subgroup of SL2(Z) 
containing ^{N). Let N' be the "width" of the cusp oo for T, i.e., the 

positive integer defined byTr\{Q^) = ^^^). Let f be a modular form on 
r of weight k, with coefficients in a discrete valuation ring R contained in C. 
Let F be the residue field of R, and suppose that the image ^ anQ^^^' in 
F[[q^l^']\ oftheq-expansion off has an = Oforalln < A;[SL2(Z) : r]/12. 
Then a„ = for all n, i.e., f is congruent to modulo the maximal ideal 
ofR. 

This result of Sturm gives as a direct consequence a bound for up to where 
one has to take so that one gets a system of generators of the Hecke alge- 
bra as Z-module, for a given level and weight. See Section 9.4 of [Ste2] for 
a detailed proof of Sturm's result, and of this consequence. For convenience 
we also state and prove this result in the precise context where we use it. 

2.5.10 Theorem Let N > 1 and k > 1 be integers, and let T{N, k) be 

the Hecke algebra attached to Sk{Ti{N)), i.e., T{N, k) is the Z-submodule 
ofEndc{Sk{Ti{N))) generated by the T^, for n > I, and the {a), for 
a in (Z/iVZ)^. Then T{N, k) is generated, as Z-module, by the Ti with 
l<i< A;[SL2(Z) : ri(Ar)]/12. 

Proof Let S be the Z-module Sk{Ti{N),Z). Then by (2.4.9) we have iso- 
morphisms of T(iV, A;)-modules: S = T{N, k^ , and T{N, k) = S"^ . Now 
the result of Sturm above says that for each prime number p, the elements Tj, 
1 < z < fe[SL2(Z) : ri(iV)]/12, generate the Fp-vector space Fp(g) S"^, and 
hence they generate ¥p (g) T{N, k). So, indeed, these Tj generate T{N, k) as 
a Z-module. □ 

We can now state a complement to Theorem 2.5.7. 

2.5.11 Proposition In the situation of Theorem 2.5.7, the Hecke alge- 
bra T(nZ,2) is generated, as Z-module, by the Hecke operators Ti with 
l<i< [SL2(Z) : ri(nZ)]/6. 
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We remark that, stiU in the same situation, giving generators of m j is then a 
matter of simple linear algebra over F; in a vector space of suitably bounded 
dimension. 

We consider the particular case of a mod I eigenform of level one and of 
weight k, viewed as a ring morphism / from T(l, k) to a finite extension 
of F/. Then we have the following result, that states explicitly how the 
Galois representation attached to / is realised in the Jacobian Ji{l){Q). 
Recall that T(/, 2), the Hecke algebra acting on weight two cusp forms on 
ri(/), is generated as Z-module by the Tj with 1 < j < {P-l)/6. 

2.5.12 Theorem Let / be a prime number, let k be an integer such that 
2 < k < l+l, and / : F; (g) T(l, A;) — > F a surjective ring morphism with F a 
finite field of characteristic I, such that the associated Galois representation 
p: Gal(Q/Q) GL2(F) is irreducible. Let /2 : F, (g T(/, 2) ^ F be the 
morphism of rings such that for all m & Z>i we have f2{Tm) = f{Tm) 
(see Theorem 2.5.7). Let {ti, . . . ,tr) bea system of generators for ker(/2). 
Let: 

Vf:= fl ker(t„Ji(/)(Q)[/]). 
l<i<r 

Then Vf is a 2-dimensional F-vector space realising p. Forp ^ I prime, {p) 
acts on Vf as multiplication byp^~'^. 

One can obtain a system of generators of ker(/2) as follows. For i in 
{1, . . . , (/2 - l)/6}, either f{Ti) is an ¥i-linear combination of the f{Tj) 
with j<i, or it is not. If it is not, then let ti = 0. If it is, then pick one: 
fiTi) = Ej<iHjfiTj), and let ti = Ti - T.J<^a^,jTj. 

Proof Just as in the proof of Theorem 2.5.7, we use Theorem 9.2 of [Edil], 
but this time in the case of level one. Case 1 of that theorem deals with the 
k that satisfy 2 < k < I. Case 3 deals with the case k = I, because p, being 
unramified outside {/}, and being irreducible of dimension two, is ramified 
at I. Case 4 deals with the case k = l+l, because there are no nonzero cusp 
forms of weight two and level one. □ 

We also state the following definition and theorem here, because the result, 
to be used later, is directly related to Theorem 2.5.7. The theorem is due, 
again, to "many people", just as Theorem 2.5.7 itself. 
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2.5.13 Definition Let > 1, and let I^ICn] be the subring of C generated 
by a root of unity of order A^. To a pair {E/S/Z[l/N, (n],P) consisting 
of an elhptic curve E over a Z[l/A^, (^a?] -scheme S, together with a point 
P in E{S) that is of order N everywhere on S, we associate another such 
pair {E'/S'/Z[1/N,Cn],P') as follows. Let 13 : E ^ E' be the isogeny 
whose kernel is the subgroup of E generated by P. Let j^^ : E' — )■ E 
be the dual of /3 (see Section 2.5 of [Ka-Ma]). Let P' be the unique el- 
ement of kcr(/3^)(S') such that ep{P,P') = C,n, where is the perfect 
//AT-valued pairing between ker(/3) and ker(^^) as described in Section 2.8 
of [Ka-Ma]. This construction induces an automorphism W(^^ of the modu- 
lar curve X\{N)i{iip^^Qj^T^, called an "Atkin-Lehner pseudo-involution". 

2.5.14 Theorem In the situation of Theorem 2.5.7 the completion x 

of T at rrif x is Gorenstein, i.e., the Zi-linear dual ofTmfx i^ of 
rank one as T^f ^-inodule. For all r > I, the (Z/rZ) (g) T^^^-modu7e 
Ji (n/) (Q) [r']mf,x is free of rank 2. 

For any t in T we have = wtw~^, where is the dual of t as en- 
domorphism of the self-dual AbeUan variety «^i('T'OQ(Cn()' where w is 
the endomorphism of ■^i('^OQ(Cn!) induced via Picard functoriality by the 
automorphism Wi;^^ of Xi(nOQ(c„,)- 

For r > 0, let (•, ■)r denote the Weil pairing on Ji{nl){Q)[F], and let 
{■,-)r denote the pairing defined by: 

{x,y)r = {x,w{y))r. 

Then {■,-)r is a perfect pairing on Ji{nl){Q)[F] for which the action 
of T is self-adjoint. As a consequence, (•, •)r induces a perfect pairing 
onJi{nim)[r]mf,x- 

Proof See Sections 6.4 and 6.8 of [Edil]. □ 

2.5.15 Remark See Corollary 4.2 of [Wie2] for a proof that T^^ ^ is not 
Gorenstein if the multiplicity of pf in Vf is not one. 

The next result gives an effective criterion whether two modular forms give 
isomorphic residual Galois representations. 
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2.5.16 Proposition Let I be a prime number, ¥ a finite extension of F/, ki 
and k2 in Z>o, and fi : T(l, ki) — > F and ■ /C2) — ^ F twomorphisms 
of rings, and i in {0, ... ,1—2}. Then pf^ and pf^ ® x\ isomorphic 
if and only if ki = k2+2i in Z/(Z— 1)Z and for all primes p 7^ I with 
p < (Z2-l)/12 we have h{Tp) = p'h{Tp). 



Proof Assume first that pf^ and pj^ isomorphic. Then we have 

= det(/9/2 ® Xi)» hence xf^^^ = xf^ hence ki = k2+2i in 

Z/(/— 1)Z. For all primes p I, we have /i(Tp) = p^f2{Tp) because they 
are the traces of the images under p and pj,^ X/ of the Frobenius at p. 

Assume now that ki = k2+2i in 1)Z and that for all primes 

p ^ I with p < {f-l)/12 we have fi{Tp) = p'f2{Tp). Then detp/^ 
and det(p/2 <X) xj) are equal, hence it suffices to prove that for all primes 
p 7^ /we have: h{Tp) = p' f2{Tp). 

We will use some theory on "Katz modular forms"; see Sections 2 and 3 
of [Edil] for a short account. For a in Z, we denote by Ma(l, F;) the space 
of Katz modular forms of level one and weight a over F; , and by S'^ ( 1 , F/ ) its 
subspace of cuspidal forms. Our reason to use Katz modular forms over F; 
is that this gives us the Hasse invariant A in Mi_i{l, F;) and the operators 
9: Ma(l,F;) S'(j+;_|.i(l,F/), for all a G Z>o, that, on g-expansions, act 
as the differential operator q-d/dq. See [Edil, §3] for the properties of 9 that 
we will use. 

The idea in what follows is to use 9 to pass to eigenforms that are anni- 
hilated by Ti, and to pass to eigenforms of weight at most 1 by dividing 
by A as many times as possible. Recall that the (/-expansion of A is the 
constant 1. 

We write 9^~^fi = A^^f[, with ni maximal, and we let k[ be the 
weight of /(. Then k[ < f-\ by Theorem 3.4 of [Edil] and the def- 
inition of ^-cycles; note that l+l + (Z— 2)(Z+1) = t^—l. Similarly, we 
write 6''~^~*/2 = ^"^/2» with n2 maximal, and we let k'2 be the weight 
of Then k'^ = k'2 in 1)Z, /{ and /2 are eigenforms, annihilated 

by Ti, and with the same eigenvalues for all Tp with p < (/^— 1)/12 prime. 
This implies that for all m < (/2-l)/12 we have /((T^) = f2{Tm). If 
k[ > k'2, then /( = A(*^i-'=2)/{'-i)/^ by Sturm's bound in this case: if 
the difference were non-zero, then the order of vanishing at 00 contradicts 



bookarxiv March 23, 2010 



MODULAR CURVES, MODULAR FORMS, LATTICES, GALOIS REPRESENTATIONS 65 

the degree of the Une bundle of which it is a section. If k'2 > k'l, then 
/2 = ^('^2~'=i)/('~i) for the same reason. We conclude that for all primes 
p ^ Z we have h (Tp) = p'f2 (Tp). □ 

2.5.17 Remark Proposition 2.5.16 can be generalised to forms of higher 
level, by the similar trick of passing to a higher level n at which one has 
forms that gave the same Galois representation, but with eigenvalue for all 
Tp with p dividing n. 

The next result gives some conditions under which the Galois representation 
p attached to a surjective ring morphism / : T{l,k) has large image in 
the sense that is contains SL2(F). It is an effective version of Theorem 5.1 
of [Ribl]. We will need such a result later on. 

2.5.18 Theorem Let k be a positive integer, I a prime number with 
I > 6{k — 1), F a Unite field and I its characteristic, and f : T(l, k) ^ ¥ 
a surjective morphism of rings such that the associated Galois representa- 
tion p: Gal(Q/Q) GL2(F) is irreducible. Then the image of p con- 
tains SL2(F), and is equal to the subgroup of GL2(F) of elements g whose 
detemainant is in the subgroup of k— 1th powers in ¥^ . 

Proof As T(l, A;) = for < 12, we have k > 12, and hence I > 66. As 
I > 2 and p is odd, p is absolutely irreducible. We also have k < I + 1. 

We apply what is known about the restriction of p to an inertia subgroup 
I at L We denote by ip and ip' := V'' the two fundamental characters from 
/ to F^^ of level 2 (the tame quotient of / is the projective hmit of the F^^ 
and the fundamental characters of level n to F;^ are those that are induced 
by ring morphisms F/n ¥1). By Theorems 2.5 (due to DeUgne) and 2.6 
(due to Fontaine) in [Edil], we have: 



P\i=\ \ J if /(TO 7^0, and 




¥i^wp\i={^^ if/m) = 0. 



The classification of subgroups of GL2 (F) of order prime to I (see for ex- 
ample [Ser3, §2.5, Prop. 16]) says that the image in PGL2(F) of such a 
subgroup is either cyclic, dihedral or isomorphic to A4, S4 or A5. 
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As p is absolutely irreducible, its image in PGL2(F) cannot be cyclic 
(note that the kernel of GL2(F) PGL2(F) is the center of GL2(F)). 

Let us show that the projective image of p cannot be A4, 54 or A^. As- 
sume that it is. Then the image of p{I) in PGL2(F) is cyclic and has order 
at least {I — l)/{k — 1) (the order of / tp' is I + 1). As we assume that 
Z — 1 is at least 6(A; — 1), this image has an element of order at least 6, a 
contradiction. 

Let us show that the projective image of p is not dihedral. Assume that it 
is. Then the image of p is contained in the normaliser of a Cartan subgroup 
(i.e., the group of points of a split or non-split maximal torus), and there is 
a quadratic extension of Q such that p is the induction from Ga\{Q/K) 
to Gal(Q/Q) of a character of Ga\{Q/K) that is not equal to its conjugate 
under Gal{K/Q). As p is unramified outside I, K must be the quadratic 

extension of Q that is ramified precisely at Z. As Z — 1 > 2{k — 1) the 

2 

description above of p|/ shows that there are precisely two lines in F^ whose 
orbit under p in (F^) has order at most 2: these are the coordinate axes (in 
the first case, the extension must be split). But in the first case the characters 
on these two lines are not conjugate under Gal(ir/(Q), and in the second 
case the action of p on the set of these two lines is not ramified. These 
contradictions show that the image of p cannot be dihedral. 

We conclude that the order of the image of p is divisible by /. As Z > 3 
a result of Dickson, see [Dic2], Chapter Xll, or rather the proof of Theo- 
rem 2.5 in [Rib4], says that the image of p in PGL2(F) is, after suitable 
conjugation, equal to PGL2(F') or SL2(F')/{1, -1} for some subfield F' 
of F. 

We claim that F' = F. Assume that it is not. We let /' and p' be the con- 
jugates of / and p by the Frobenius automorphism of F over F'. Then p and 
p' are not isomorphic because the traces of the image of p generate F (use 
that T(l, k) is generated as Z-module by the Tj with i < k/12 < I). But 
their projective representations to PGL2(F) are equal. Hence p' is a twist 
of p by some character x'- Gal(Q/(Q) — )• F^. As p and p' are unramified 
outside I, X is unramified outside I and hence a power of xi- But then we 
have ^'+^/ = Of, with 9 as in the proof of Proposition 2.5.16. A look at 
the theta cycles in Section 3 of [Edil] or Section 7 of [Joe] shows that then 
k = (/ + 3)/2 if /(Ti) = 0, and A; = (Z + l)/2 if /(T,) ^ 0. This contradicts 
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our assumption that I > 6{k — 1). 

So the image G of p in PGL2(F) contains the image of SL2(F). Then, for 
each a e¥,G contains elements of the form ( q ? ) and ( ^ ° ), for some t and 
s in . Taking suitable powers, we conclude that G contains all ( J f ) and 
( ^ 5 )' where a ranges through F. These generate SL2(F). As det p = Xi~^ 
the last claim in the theorem follows. □ 

2.5.19 Remark Eigenforms / : T(l, /c) — > F such that the projective image 
of p is A4, S4 or A5 are related to complex modular forms of weight one 
and level I or Z^, see [Kh-Wil], Theorem 10.1. There are tables of these. 
For example, in [Ba-Ki], page 1 10, one finds an As-example with I = 2083, 
and an S'4-example with I = 751. See also Section 4.3 of [Ki-Wi]. We note 
that for / = A the prime 23 with 23 — 1 = 2(12 — 1) nicely illustrates one 
of the arguments that is used in the proof above: p is then dihedral. More 
generally, / with p dihedral come from class groups of imaginary quadratic 
orders that are unramified outside I. 
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Chapter Three 



First description of tine algoritlims 

B. Edixhoven and J.-M. Couveignes 

We put ourselves in the situation of Theorem 2.5.7, and we ask how we 
can compute the Galois representation. More explicitly, let n and k be pos- 
itive integers, F a finite field and / its characteristic, and /: T(n, A;) — F 
a surjective ring morphism. Assume that 2 < k < l+l, and that the asso- 
ciated Galois representation p: Gal(Q/Q) — > GL2(F) is absolutely irre- 
ducible. Let /2 : T(nZ, 2) — > F be the weight two eigenform as in The- 
orem 2.5.7 and let m = ker(/2). Assume that the multiphcity of p in 
V := Ji(nl)(Q)[m] is one, i.e., that p is realised by V. 

We let K C Q be the field "cut out by p", i.e., the finite Galois extension 
of Q contained in Q consisting of the elements of Q that are fixed by all 
elements in ker(p). Then we have, by definition, the following factorisation 
of p: 

p: Gal(Q/Q) ^ Ga\{K/q) ^ GL2(F). 

Our aim is then to compute such residual representations p, in time poly- 
nomial mn,k and #F. By computing p we mean giving if as a Q-algebra, 
in the form of a monic polynomial in Q[T] that is the minimal polynomial 
of some generator t of K, and giving the elements a of GaliK/Q) by giv- 
ing their matrices with respect to the Q-basis of K consisting of the first so 
many powers of t, together with the element p{a) of GL2(F). Once given 
such an explicit description of p it becomes possible to compute f{Tp) G F 
in deterministic polynomial time in log p. Indeed this boils down to comput- 
ing the Frobenius endomorphism at p for the algebra A. Chapter 15 explains 
how to do this. 
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It will be convenient for us to use the modern version of Galois theory 
that says that the functor A i-^ HomQ(A, Q) is an anti-equivalence from 
the category of finite separable Q-algebras to that of finite discrete (con- 
tinuous) Gal(Q/Q)-sets. An inverse is given by the functor that sends X 
to HomQg^j^QyQ^(X, Q), the Q-algebra of functions / from X to Q such 
that f{gx) = g{f{x)) for all g in Gal(Q/Q) and all x in X. Under this 
correspondence, fields correspond to transitive Gal(Q/Q)-sets. 

As a first step towards the computation of p we let A be the Q-algebra 
corresponding to the Gal(Q/Q)-set V. Before we explain our strategy to 
compute A, we sketch how one gets from AtoK and p. The Q-algebra 
corresponding to F x F is A (g) A. The addition map V x V ^ V corre- 
sponds to a morphism A^A'SiA,the co-addition. The -action on V 
corresponds to an -action on A. We will see later that the co-addition 
and the -action on A can be computed by the same method by which A 
will be computed. Viewing V x V as HomF(F^, V) gives a right-action 
by GL2(F) onVxV, hence a left-action on A (g) A. This action can be 
expressed in the co-addition and the F^ -action. Let B be the Q-algebra 
corresponding to the subset IsomF(F^, V) of HomF(F^, V). This factor B 
of AiSi A can be computed by hnear algebra over Q, using the GL2(F)- 
action on ^ (g) A. In terms ofVxV, one removes the subset of (^1,^2) 
that are linearly dependent, i.e., the point (0,0) and the GL2(F)-orbit of 
{V - {0}) X {0}. The field K then corresponds to a Gal(Q/Q)-orbit in 
Isom(F^, V), hence is obtained by factoring i? as a product of fields, us- 
ing factoring algorithms, and choosing one of the factors. See [Le-Le-Lo], 
[Lenl] and [Lanl] for the fact that such factoring can be done in polynomial 
time. The equivalence between factoring algebras and polynomials is given 
in [Len2]. Let G C GL2(F) be the stabiliser of the chosen factor K. Then 
G = Gal(i<'/Q) and the inclusion is a representation from G to GL2(F). 
Let (j) be in the chosen Gal(Q/Q)-orbit in IsomF(F^, V). As this orbit is a 
right G-torsor on which Gal(Q/Q) acts, there is, for every a in Gal(Q/Q), 
a unique g{a) in G such that p{a) o = ^ o g{a). Note also that evaluation 
at ^ is an embedding of K in Q, such that a in Gal(Q/Q) induces g{a) 
on K. It follows that is an isomorphism between p and the representation 
g: Gal(Q/Q) ^ Gal(iC/Q) = G C GL2(F). 

We now turn to the question of how to compute the Q-algebra A cor- 
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responding to V. We wish to produce a generator of A, and its minimal 
polynomial over Q. This means that we must produce a Q-valued function 
a on y such that a{ax) = a{k{x)) for all x in F and all a in Gal(Q/Q). 
Such a function is a generator of A if and only if it does not arise from a 
strictly smaller quotient of V as Gal(Q/Q)-set (such quotients correspond 
to subalgebras), hence, equivalently, if and only if a is injective. The mini- 
mal polynomial over Q of such a generator a is given as follows: 

(3.1) P{T)=l[{T-a{x)). 

xev 

The question is now how to produce such a generator? A direct way 
would be to compute the elements of F in Ji(nZ)(Q), by writing down 
polynomial equations in a suitable coordinate system that is defined over Q, 
and solving them, using computer algebra. This is essentially how Schoof 's 
algorithm deals with elliptic curves. However, the dimension of Ji(nZ) is 
quadratic in I. Writing down equations in polynomial time still seems pos- 
sible. But we do not know of a way of solving the equations in a time that 
is not exponential in the dimension. 

The decisive idea is to use numerical computations to approximate the 
coefficients of a minimal polynomial P as above, in combination with a 
bound on the height of those coefficients. We recall that the (standard, log- 
arithmic) height of a rational number a/b, with a and b integers that are 
relatively prime, is logmax{|a|, \b\} (a variant would be log(a^ + This 
rational number x = a/b is known if we know an upper bound h for its 
height, and an approximation y of it (in R, say), with \x — y\ < e~'^^ j1. 
Indeed, ifx' = a'/b' also has height at most h, and x' ^ x, then: 



/I 

X 



ab' - ba' 



by 



1 66' I 



We also note that there are good algorithms to deduce x from such a pair 
of an approximation y and a bound h, for example by using continued frac- 
tions, as we will now explain. 

In practice we will use rational approximations y of x. Every rational 
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number y can be written uniquely as: 

1 

[ao,ai, . . . ,a„] = ao H 



ai + 



1 

1n-l + 



On 

where n G Z>o, ao € Z, G Z>o for all z > 0, and a„ > 1 if n > 0. To 
find these ai, one defines ao := [yj and puts n = if y = ao; otherwise, 
one puts yi := l/{y — ao) and ai = [yij and n = 1 if yi = a\, and so 
on. The rational numbers [ag, ai, . . . , Oi] with < f < n are called the 
convergents of the continued fraction of y. Then one has the following well 
known result, see Theorem 184 from [Ha-Wr]. 

3.2 Proposition Let y be in Q, a and binZ with and: 

1 



b-y 



^ 262' 



Then a/bis a convergent of the continued fraction of y. 

The question is now: how we are going to implement this method? 
The basic idea in doing this is to not work on the Abehan variety J\{nl) 
but rather on the product Xi{niy of copies of Xi{nl), where g is the 
genus of Xi{nl). To compare the two, we first choose an effective divi- 
sor Z^o = Pi + ■ ■ ■ + Pg on Xi{nl)iQ, and we consider the well-known 
map: 

Xiiniy Ji(nZ), 
(3.3) ^ ^ ^ ^ 

(Qi, ...,Qg)^[Qi + --- + Qg- Do]. 

To understand the definition of this map rigorously, one must use the 
interpretation of Xi{nl) as its functor of points with values in Z[l/nl]- 
schemes, and that of Ji(nZ) as the degree zero part of the relative Picard 
functor P^c^Xi{ni)/'Z,[i/ni]- necessary background on this, see Chap- 

ters 8 and 9 of [Bo-Lu-Ra]. The divisor Dq lives on Xi{nl)(Q, and it ex- 
tends uniquely over Z[l/ nl] to an effective relative Cartier divisor of degree 
g on Xi{nl). The points Pj of which Dq is the sum need not be rational 
over O. 
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The inverse image of a point x in Ji{nl){Q) under the map (3.3) can be 
described as follows. Let Cx denote a line bundle of degree zero on Xi {nl)q 
that corresponds to a; (x is an isomorphism class of such hne bundles). Then 
the inverse image of x is the set of {Qi, . . . , Qg) such that jCx has a rational 
section whose divisor is Qi + ■■■ + Qg — Dq, or, equivalently, the set of 
(Qi, . . . , Qg) such that there is a non-zero section of jO,x{Do) with divisor 

Ql + '-' + Qg- 

When X ranges over Ji{nl){Q), the class of the CxIDq) ranges over the 
set Pic^(Xi(n/)Q). The function on Ji(nl)(Q) that assigns to x the di- 
mension hP{Cx{DQ)) of the space of global sections of Cx{Dq) is semi- 
continuous in the sense that for each i the locus of x where hP{jCx{Do)) > i 
is closed (the condition hP{jCx{Do)) < i need not be closed). On a non- 
empty open subset of Ji(nZ)(Q) this value is one, as can be seen using the 
theorem of Riemann-Roch, and Serre duality. This means that for x outside 
a proper closed subset of Ji(n/)(Q), the inverse image in Xi{nl)^ (Q) of 
X consists of the ^-tuples obtained by permutation of coordinates of a sin- 
gle {Qi, . . . , Qg). Another way to express this is to say that the map (3.3) 
above factors through the symmetric product Xi(n/)'^^' and that the map 
from Xi (nl)^^^ to Ji (nl) is birational (i.e., an isomorphism on suitable non- 
empty open parts). 

It is then reasonable to assume that we can take Dq such that for all xinV 
there is, up to permutation of the coordinates, a unique Q = {Qi, . . . ,Qg) 
in Xi{nl)^ (Q) that is mapped to x via the map (3.3). On the other hand, 
on a curve of high genus such as Xi {nl) it is not clear how to make a large 
supply of inequivalent effective divisors Do on Xi{nl)Q. We will see later, 
in Theorem 8.1.7, that we can indeed find a suitable divisor, supported on 
the cusps, and defined over Q(0)' on the Xi{5l), which will suffice for 
treating almost all modular forms of level one. 

Remark. In situations where such a cuspidal divisor cannot be found, one 
could try at random Pi,...,Pg in Xi{nl){L), corresponding to elliptic 
curves lying in one isogeny class, with complex multiplications, for exam- 
ple by Q{i). Then L is a solvable Galois extension of Q, so that K can be 
reconstructed from the compositum KL. If one chooses the Pi reasonably, 
the degree of L and the logarithm of the discriminant of L are polynomial 
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in Another possibihty is to try to work with a divisor Dq of degree smaller 
than g, for example a multiple of a rational cusp. 

Let us now assume that we have a divisor Dq as described above. Then 
we choose a non-constant function: 

that will have to satisfy some conditions that will be given in a moment. 

With these two choices, Dq and /, and a choice of an integer m, we get 
an element aDo,f,m of the Q-algebra A corresponding to V as follows. For 
X in F we let = Qx,i + • • • + Qx,g be the unique effective divisor of 
degree g such that: 

(3.4) x=[Dx-D^]. 

Note that indeed for x = we have = -Do- We assume that for all 
X G y the divisor is disjoint from the poles of /. Then, for each x in V, 
we define: 

9 

PDoJ,. = ]\{t-f{Qx,d) inQM. 

1=1 

We then get an element aDo,f,m of A by evaluating the PDo,f,x at ^• 

g 

(3.5) aDoj,m- y — ^ Q, PdoJ,x{^) = ~ f{Qx,i))- 

i=l 

The condition that all the are disjoint from the locus of poles of / will 
not be guaranteed to hold later when we treat forms of level one, but then it 
will be possible to omit the Qx,i at which / has a pole from the sum in (3.5) 
(/ will have its poles at certain cusps). For the moment, let us just assume 
that this condition is satisfied. Then the f*Dx, for x in F, are effective 
divisors of degree g on A^. 

We will choose / in such a way that the f*Dx are distinct; we assume now 
that this is so. Then there is an integer m> with m < g-{^¥)^ such that 
aDo,f,m is injective, and hence a generator of A: the polynomials PdoJ,x 
are distinct when x varies, and m must not be a root of any difference of 
two of them. 
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Finally, we want to have control on the heights of the coefficients of the 
minimal polynomial of aDo,f,m, because these heights determine the re- 
quired precision of the approximations of those coefficients that we must 
compute. The whole strategy depends on the possibiUty to choose a divi- 
sor Do and a function /, such that, when n, k and F vary, those heights 
grow at most polynomially in n, k and ^^F. Using a great deal of machinery 
from Arakelov theory, we will show (at least in the case n = 1) that any 
reasonable choices of Dq and / will lead to an at most polynomial growth 
of those heights. Intuitively, and completely non-rigorously, one can believe 
that this should work, because of the following argument. Our x are torsion 
points, so that their Neron-Tate height is zero. As x and Dq determine D^, 
the height of should be not much bigger than the height of Dq. As we 
choose Dq ourselves, it should have small height. Finally, the height of 
o-Do,f,m should be not much bigger than the sum of those of / and m and 
the Dx- Turning these optimistic arguments into rigorous statements implies 
a lot of work that will be done in Chapters 9-1 1. An important problem here 
is that in Arakelov theory many results are available that deal with a single 
curve over Q, but in our situation we are deaUng with the infinitely many 
curves Xi{nl) as I varies. 

A few words about the numerical computations involved. What we need 
is that these can be done in a time that is polynomial in n and #F and 
the number of significant digits that one wants for the coefficients of the 
minimal polynomial PDaJ,m of aD^^j^m- It is not at all obvious that this 
can be done, as the genus of Xi(nl) and hence the dimension of Ji{nl) are 
quadratic in I. 

One way to do the computations is to use the complex uniformisations 
of Xi{nl){G) and Ji(nZ)(C). The Riemann surface Xi(nZ)(C) can be ob- 
tained by adding finitely many cusps (the set Fi (n/)\P^ (Z)) to the quotient 
ri(n/)\EI (see Section 2.1). This means that Xi(n/)(C) is covered by disks 
around the cusps, which are well suited for computations (functions have 
g-expansions, for example). In order to describe Ji{nl){C) as modulo 
a lattice, we need a basis of the space of holomorphic differential forms 
H°(Xi(nZ)(C), Q?-). The basis that we work with is the one provided by 
Atkin-Lehner theory, as given in (2.2.17); we write it as w = (wi, . . . , ujg). 
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Then we have the following complex description of the map (3.3): 

(3.6) Xi {nl) (C)9 ^ Ji inl) (C) ^=^= C^/A 



(Qi, . . . , Q,) I [ELi Qi - Ef=i Pi] — E / ^, 

where A is the period lattice with respect to this basis, i.e., the image of 
Hi(Xi(n/)(C), Z) under integration of the u-i. This map can be computed 
up to any desired precision by formal integration of power series on the 
disks mentioned above. The coefficients needed from the power series ex- 
pansions of the oji can be computed using the method of modular symbols, 
as has been implemented by William Stein in Magma (see his book [Ste2]). 
We note that modular symbols algorithms can be used very well to locate 
V inside l^^A/A, hence in Ji{nl){C). A strategy to approximate a point 
Qx = {Qx,i, ■ ■ ■ , Qx,g) as above for a non-zero x in V is to lift the straight 
line that one can draw in C^/ A from to a; (within a suitable fundamental 
domain for A) to a path in Xi(n/)(C)^ starting at (Pi, . . . , Pg). In practice 
this seems to work reasonably well, see Bosman's Chapters 6 and 7. A the- 
oretical difficulty with this approach is that one needs to bound from below 
the distance to the ramification locus of Xi{nl)^^^ — > Ji(nZ). Chapter 12 
gets around this difficulty and provides a proven algorithm for inverting the 
Jacobi map (3.3). The starting idea is to set y = x/N for a large enough 
integer. This y is no longer an /-torsion point but it is close to the origin in 
the torus Ji{nl){C), and this helps finding a preimage Qy of y, because the 
behaviour of the Jacobi map (3.3) is well understood at least in the neighbor- 
hood of the origin. The divisor we are looking for is such that Qx — Do 
and N{Qy — Dq) are Unearly equivalent. So Qx can be computed from Qy 
by repeated application of an expUcit form of the Riemann-Roch theorem. 
The resulting algorithm reduces to computing approximations of the com- 
plex zeros of a great number of modular forms with level 5/ and weight 4. 
Chapter 5 explains how to approximate the complex zeros of entire series. It 
also contains a reminder of the necessary notions from computational com- 
plexity theory. 

Another way to do the "approximation" is to compute the minimal poly- 
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nomial Pooj^m of aD„j,m modulo many small primes p. Indeed, the 
map (3.3) can be reduced mod p. In this case one has no analytic description 
of the curve and its Jacobian, but one can make random points in Ji (nl) (Fg) 
for a suitable finite extension ¥p ¥q. Such random points can then be 
projected, using Hecke operators, into V. Elements of Ji{nl){¥q) can be 
represented by divisors on Xi{nl)¥^, and all necessary operations can be 
done in polynomial time. This approach is explained in detail in Chap- 
ter 13. In order to deduce a rational number x = a/h from the knowledge 
sufficiently many of its reductions modulo primes p not dividing b we have 
the following well-known result. 

3.7 Proposition Let x = a/b be inQ, with a and b inZ, relatively prime. 

Let M = max{|a|, Let S be a finite set of prime numbers p with p 
not dividing b, such that Ylp^sP ^ 2M^. For each p in S, let Xp in ¥p be 
the reduction of x, and let L <Z 1? be the submodule of (n, m) with the 
property that for all p in S: n — Xpin = in ¥p. Then (a, 6) and {—a, —b) 
are the shortest non-zero elements of L with respect to the standard inner 
product on M^, and the lattice reduction algorithm in dimension two, Algo- 
rithm 1.3.14 in [Coh], finds these in time polynomial in log M. 

Proof The lattice reduction gives a shortest non-zero element, so it suffices 
to show that, under the assumptions in the Proposition, the two shortest non- 
zero elements of L are precisely ±(a, b). The volume of R^/L is the index 
of L in Z^, hence equals Hpes P- Let h be a shortest non-zero element of L. 
Then ||Zi|| < ||(a, < \/2M. Let ^2 in ^ be linearly independent of h. 
Then: 

2M^ < Vol(MVi) < Vo1(mV(Z-Zi +Z-^2)) < WhHhW < V^MWhl 

Hence ||/2|| > \/2M > ||(a,6)||. It follows that (a, 6) and h are linearly 
dependent, and hence h = ±{a,b). □ 

Remark. In case one has a natural rigid analytic uniformisation at some 
prime p, one may want to use that. For the modular curves that we are 
dealing with this is not the case, but the closely related Shimura curves 
attached to quaternion algebras over Q do admit such uniformisations at the 
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primes where the quaternion algebra is ramified (as was proved by Cerednik, 
Drinfeld, see [Bo-Ca]). 
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Short introduction to lieiglits and Arakelov tlieory 

B. Edixhoven and R. de Jong 

In Chapter 3 it has been explained how the computation of the Galois rep- 
resentations V attached to modular forms over finite fields should proceed. 
The essential step is to approximate the minimal polynomial P of (3.1) with 
sufficient precision so that P itself can be obtained. The topic to be ad- 
dressed now is to bound from above the precision that is needed for this. 
This means that we must bound the heights of the coefficients of P. As was 
hinted to in Chapter 3, we get such bounds using Arakelov theory, a tool 
that we discuss in this section. It is not at all excluded that a direct approach 
to bound the coefficients of P exists, thus avoiding the comphcated theory 
that we use. On the other hand, it is clear that the use of Arakelov theory 
provides a way to spht the work to be done in smaller steps, and that the 
quantities occurring in each step are intrinsic in the sense that they do not 
depend on coordinate systems or other choices that one could make. We 
also want to point out that our method does not depend on cancellations of 
terms in the estimates that we will do; all contributions encountered can be 
bounded appropriately. 

A good reference for a more detailed introduction to heights is Chap- 
ter 6 of [Co-Si]. Good references for the Arakelov theory that we will use 
are [Fall] and [Mor2]. A general reference for heights in the context of 
Diophantine geometry is [Bo-Gu]. 

4.1 HEIGHTS ON Q AND Q 

The definition of the height of an element of Q has already been given in 
Chapter 3; for x = a/b with a and b ^ relatively prime integers, we 
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have h{x) = logmax{|a|, We will now give an equivalent definition 
in terms of absolute values |-|^ on Q attached to all places v of Q, the finite 
places, indexed by the prime numbers, and the infinite place denoted oo. 

The absolute value |-|oo is just the usual absolute value on R, restricted 
to Q. We note that R is the completion of Q for | loo- For p prime, we let Vp 
be the p-adic valuation: 

(4.1.1) Vp-.l — ^Zu{oo}, 

sending an integer to the maximal number of times that it can be divided 
by p. This valuation Vp extends uniquely to Q subject to the condition that 
Vp{xy) = Vp{x) + Vp{y); we have Vp{a/b) = Vp{a) — Vp{b) for integers a 
and 6 7^ 0. We let | • \p denote the absolute value on Q defined by: 

(4.1.2) \x\p=p-M-), |0|p = 0. 

The completion of Q with respect to | • |p is the locally compact topological 
field Qp. An important property of these absolute values is that all together 
they satisfy the product formula: 

(4.1.3) JJ|a;|„ = l, for all x in Q^. 
With these definitions, we have: 

(4.1.4) h{x) = log max{l, |a;|„}, forallxGQ, 

V 

where v ranges over the set of all places of Q (note that almost all terms in 
the sum are equal to 0). 

The height function on Q generahses as follows to number fields. First 
of all, for a local field F we define the natural absolute value | • | on it by 
letting, for a; in F^, be the factor by which all Haar measures on F are 
scaled by the homothecy y ^ xy on F. For example, for F = C we have 
l^lc = zz = jzp, the square of the usual absolute value. Let now i^" be a 
number field. By a finite place of K we mean a maximal ideal of Ok- An 
infinite place of K is an embedding of K into C, up to complex conjugation. 
For each place v of K, let Ky be its completion at v; as is a local field, 
we have the natural absolute value | |^ := \-\Ky on Ky and on K. In this 
case, the product formula is true (this can be shown easily by considering the 
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adeles of K, see Chapter IV, Section 4, Theorem 5 of [Wei2]). The height 
function on Q also generalises to K. For all for all re in K we define: 

hxix) := log maxjl, \x\v} = 

(4.1.5) " 

= 2_, logmaxjl, + 2. logmaxjl, |(t(x)|}. 

V finite a : K—^C 

This function hx is called the height function of K. For K ^ K' sa 
extension of number fields, and for x in K, we have 

hx'ix) = {dimx K')■hKix)■ 
TheTefoTe one has the absolute height function ^ on Q defined by: 

(4.1.6) k:Q^R. H^) = il^, 
where if C Q is any number field that contains x. 

4.2 HEIGHTS ON PROJECTIVE SPACES AND ON VARIETIES 

For n > and for K a number field, we define a height function on the 
projective space P"(iC) by: 

hK{{xo : ■ ■ ■ : Xn)) := ^logmax{|j;o|, • • • , |a;„|}, 
(4.2.1) I , . 



dimQ K ' 

where v ranges through the set of all places of K. We note that it is because 
of the product formula that hxix) is well-defined, and that this definition is 
compatible with our earlier definition of the height and absolute height on K 
if we view K as the complement of oo in F^{K). The functions h on ¥"-{K) 
for varying K naturally induce the absolute height function on P"(Q). 

A fundamental result, not difficult to prove, but too important to omit here 
(even though we will not use it), is Northcott's finiteness theorem. 

4.2.2 Theorem (Northcott) Let n, d and C be integers. Then: 
{x G P"(Q) I h{x) < C anddimQ(Q(a;)) < d} 

is a finite set. 
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For a proof the reader is referred to Chapter 6 of [Co-Si], or to Section 2.4 
of [SerlO]. 

For any algebraic variety X embedded in a projective space over 
some number field K, we get height functions hx on X{K) and h on X(Q) 
by restricting those from P" to X. 

For later use, we include here some simple facts. The height functions on 
the projective spaces P"(Q) are compatible with embeddings as coordinate 
planes, for example by sending {xq x„) to (a;o : • • • : a;„ : 0), or to 

(0 : : • • • : 

For all n G N, we view A"(Q) as a subvariety of P"(Q), embedded in 
one of the n + 1 standard ways by sticking in a 1 at the extra coordinate. For 
example, by sending (xi, . . . , x„) to {1 : x\ : ■ ■ ■ : Xn). This gives us, for 
each n, a height function h: A"(Q) — > R. These height functions are also 
compatible with embeddings as coordinate planes. For n = 1 the height 
function on A^(Q) = Q is the function in (4.1.6). 



4.2.3 Lemma Let n G Z>i, and xi, . . . ,Xn in Q. Then: 



h{xi) < h{{xi, . . . ,Xn)) < h{xi) + • • • + h{xn) for each i. 



Proof Let n G Z>i, and xi , . . . , x^j in Q. Let if C Q be a finite extension 
of Q containing the Xj. For the first inequahty, we have: 



n 



n 




i=l 



1=1 



hxixi ■■■Xn) = y^logmaxjl, |xi • ■ ■ Xn\v} 



V 



< \ log(max{l, |xi|^} • • • max{l, \xn\v}) 




V 



= hK{xi)-\ h hxiXn) ■ 
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For the second inequahty, let x = xi H + x„. Then we have: 

hxix) = logmaxjl, |y~]xi|„}+ ^ Iogmax{l, |cr^2;i|} 

V finite i ^ ■ K^Q * 

< logmax{l, max |a;i|„} + logmaxjl, |(T(xi)|} 

V finite <T i 

< log maxjl, \xi\y} + maxjO, log(n- max 

V finite i cr 

< ^ logmax{l, \xi\v} + log n + max{0, log 

V finite,? c iT,i 

= (dimQ K)- logn + ^ hxixi) . 

i 

For the third inequahty, let z be in {1, ... , n}. We have: 

hxixi, . . . = /tx(l : xi : ■ ■ ■ : Xn) 

= y~^ log maxjl, . . . , \xn\v} 

V 

>y^log maxjl, \xi\y} = hxixi) . 

V 

Finally, for the last inequality: 

hxixi, ...,Xn) = HkO- ■■ xi : ■ ■ ■ : Xn) 

= ^ log maxjl, . . . , \xn\v} 

V 

<y^y^log maxjl, \xi\y} = hxixi) H h hxixn) ■ 

V i 

□ 

4.2.4 Lemma Let d > 1 and n > d be integers. Let Tt^ denote the ele- 
mentary symmetric polynomial of degree d inn variables. Let yi, • • • , j/n 
be in Q. Then we have: 

h{'Ediyi,...,yn)) <n\og2+ ^ h{yi). 

l<i<n 

Proof Let K be the compositum of the fields Qiyi) for i = 1, . . . , n. For 
each place v of K, we let | • |^ be the natural absolute value on Ky and on K 
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as at the end of Section 4. 1 . By the triangle inequality we obtain, for each 
place V of K: 

\^d{yi,--- ,yn)\v < c{v,n) max \yi^ ■■■yijv< 

l<ii<---<Jd<n 



<c{v,n) Y[ max{l, 



l<i<n 

where c{v,n) = 2^ if v is Archimedean, and c{v,n) = 1 if is non- 
Archimedean. It follows that: 

n 

max{l, . . . < c(t;, n) JJ max{l, . 

i=l 

The proof of the lemma is finished by taking logarithms, summing over the 
places V, and dividing by dimQ K. □ 

4.2.5 Lemma Let x / be in Q, let K = Q{x), and leta: K ^C. Then: 

\a{x)\ > e-(di°iQ^)-M^). 

Proof We have: 

— log \ct{x)\ = log (|cr(a:)|~^) < logmaxjl, |(T(a;)|~"'^} 
< y~^logmax{l, = (dimQ 

V 

= {dim.(QK)-h{x), 
where the sum is over all places of K. □ 

4.2.6 Lemma Let K be a number Geld, let n be in Z>i, and let a be in 
Mn{K). Then: 

^(det(a)) < ^/i(oi.j) + -nlogn. 
Proof Let u be a finite place of K. Then we have: 



I det(a)|^ 



^l,s(l) ■ ■ ■ <^n,s(n) 

seSn 

< JJmax{l, \aij\y}. 



< max|ai^s(i)|^ • • • |a„^s(„)|^ 
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For a: K — > C we have, by Hadamard's inequahty and the comparison 
||-|| < n^/^ II -11 max in C" of the euchdean norm and the max-norm: 

|det(7(a)| < n IkKOII = n ("'^'lk(«.)llmax) 
j j 

<n"/2J]niax{l,|a(aij)|}, 

where aj is the jth column of a. Then we have: 

/ix(det(a)) = ^ logmaxjl, | det(a)|^} + ^ logmaxjl, | det cr(a)|} 

V a 

< ^^logmax{l, Ittijl^} 

V i,j 

+ -^^^Sn + ^logmaK{l,\a{aij)\} 
= ^(dimQ ■ft:)-nlog n + hK{ai,j)- 

Dividing by dimjj K gives the result. □ 

4.2.7 Lemma Let K bea number field, let n be in Z> i , let a be in GL„ (K) , 

and y in K^. Let x be the unique element in K"^ such that ax = y. Let b be 
the maximum of all h{aij) and h{yi). Then we have, for all i: 

h{xi) < 2n^b + nlogn. 

Proof We apply Cramer's rule: Xi = det(a(i))/det(a), where a{i) in 
Mn{K) is obtained by replacing the ith column by y. Lemma 4.2.6 gives 
us: 

/i(det(a)) < n^b + — nlogn, /i(det(a(i))) < n'^b+ — nlogn. 
Therefore: h{xi) = h{det{a{i)) / det(a)) < 2n^6 + nlogn. □ 



4.3 THE ARAKELOV PERSPECTIVE ON HEIGHT FUNCTIONS 

We have just defined height functions hx and hona variety X over a num- 
ber field K, embedded into some projective space P^. Such an embedding 
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determines a line bundle C on X: the restriction of the line bundle 0(1) 
of that corresponds to homogeneous forms of degree 1, in the variables 
xo, - ■ ■ ,Xn, say. The embedding of X into is given by the global sections 
sq, . . . ,SnOf £, obtained by restricting the global sections xq, . . . ,Xnto X. 
Now any finite set of generating global sections to, ■■■ ,tm of jO determines 
a morphism / : X — )• P^, inducing height functions hK, f and hf via pull- 
back along /. For / and /' two such morphisms, the difference \hf — hfi\ 
is bounded on X(Q) (see Theorem 3.1 of Chapter 6 of [Co-Si]). For this 
reason, one usually associates to a line bundle C on a variety X a class of 
height functions fc, i.e., an element in the set of functions X{Q) M mod- 
ulo bounded functions; this map is then a morphism of groups on Pic(X): 
fCi^C2 = fci + fc2 - However, in our situation, we cannot permit ourselves 
to work just modulo bounded functions on each variety, as we have infinitely 
many curves -^^1(0 to deal with. 

There is a geometric way to associate to a line bundle a specific height 
function, not just a class of functions modulo bounded functions. For this, 
the contributions from the finite as well as the infinite places must be pro- 
vided. Those from the finite places come from a model of X over the ring 
of integers Ok of K, i.e., an Oi^-scheme Xoj^ whose fibre over K is X, to- 
gether with a line bundle £ on Xoj^ whose restriction to X is the line bundle 
that we had. The Ox-scheme Xoj^ is required to be proper (e.g., projec- 
tive). The contributions from the infinite places are provided by a hermitian 
metric (or inner product) on C, a notion that we will briefly explain. 

A hermitian metric on a locally free Ox -module of finite rank £ con- 
sists of a hermitian metric (•, ■)x on all C-vector spaces x*£, where x runs 
through X{C), the set of x: Spec(C) — > X. Each x in X{C) induces a 
morphism Spec(C) Spec(K), i.e., an embedding of K into C. There- 
fore, X{C) is the disjoint union of the complex analytic varieties X^, in- 
dexed by the a: K ^ C A hermitian metric on £ consists of hermitian 
metrics on all the holomorphic vector bundles £a that £ induces on the Xa-. 
The metrics to be used are required to be continuous, i.e., for U open in X 
and s and t in £(U), the function x {s{x),t{x))x on U (C) must be con- 
tinuous. Actually, the metrics that we will use will live on non-singular X, 
and will be required to be smooth (infinitely differentiable). Another con- 
dition that is usually imposed is a certain compatibility between the metrics 
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at a point x in X{C) and its complex conjugate x. We do not give this con- 
dition in detail, but note that it will be fulfilled by the metrics that we will 
use. It is also customary to denote a hermitian metric (•, •) by its norm || • ||, 
given by \\s\\^ = (s, s). Indeed, a suitable polarisation identity expresses 
the hermitian metric in terms of its norm. A pair || ||) of a locally free 
Ox^ -module with a hermitian metric IMI is called a metrised vector bun- 
die on Xojf- Metrised vector bundles can be pulled back via morphisms 
/ : Woji Xojf between Ox-schemes of the type considered. 

An important example of the above is the case where X = Spec{K), 
just a point, and = Spec(0/i:). A metrised line bundle {C, ||-||) then 
corresponds to an invertible Ox -module, L, say, with hermitian metrics on 
the Lcr := C <8)o-,Ok L. The Arakelov degree of (£, ||-||) is the real number 
defined by: 



where s is any non-zero element of L (independence of the choice of s 
follows from the product formula). This definition should be compared to 
that of the degree of a line bundle on a smooth projective curve over a field: 
there one takes a rational section, and counts zeros and poles. The first term 
in (4.3.1) counts the zeros of s at the finite places. Interpreting this term 
in terms of valuations, and then norms, at the finite places, then leads to 
the second term which "counts" the "zeros" (or minus the "poles", for that 
matter) at the infinite places. For a finite extension K — > K', and (£, ||-||) 
on Spec(Ox) as above, the pullback {C, ||-||) to Spec(Oii:') has degree 
dimx K' times that on Spec(Ox)- 

We can now give the definition of the height given by a proper O^- 
scheme X together with a hermitian line bundle {£,, ||||). hetxhein X{K). 
Then, by the propemess of X over Ok, x extends uniquely to an O^-valued 
point, also denoted x, and one defines: 



(4.3.1) 



deg(A 11-11) = log E log 11^ 




(4.3.2) 



hxix) := degx*{C, \\-\\). 



The same method as the one use above can be applied to get an absolute 
height ^: X(Q) ^ R. For K ^ K' & finite extension, each x\nX{K') 



bookarxiv March 23, 2010 



88 CHAPTER 4 

extends uniquely to an x in X{Ok'), and one defines: 

degx*(£,|H|) 



(4.3.3) h{x) := 



diniQ K' 



It is not hard to verify that this height function h is in the class (mod- 
ulo bounded functions) that is attached to Xk and Ck (without metric); 
see Proposition 7.2 of Chapter 6 of [Co-Si], or Theorem 4.5 of Chapter V 
in [Ed-Ev]. In fact, for X = IP^^, and C = 0{l) with a suitable metric, the 
height /i just defined is equal to the one defined in (4.2.1). 



4.4 ARITHMETIC RIEMANN-ROCH AND INTERSECTION THEORY 
ON ARITHMETIC SURFACES 

The context in which we are going to apply Arakelov theory is that of 

smooth projective curves X over number fields K. In [Ara] Arakelov 
defined an intersection theory on the arithmetic surfaces attached to such 
curves, with the aim of proving certain results, known in the case of func- 
tions fields, in the case of number fields. The idea is to take a regular projec- 
tive model X over B := Spec(Oi^) of X, and try to develop an intersection 
theory on the surface X, analogous to the theory that one has when K is a 
function field. If if is a function field over a finite field k, say, one gets a 
projective surface X over k, fibred over the nonsingular projective curve B 
over k that corresponds to K. On such a projective surface, intersecting with 
principal divisors gives zero, hence the intersection pairing factors through 
the Picard group of X, the group of isomorphism classes of invertible O^"- 
modules. In the number field case one "compactifies" B by formally adding 
the infinite places of K; the product formula then means that principal di- 
visors have degree zero. Instead of the Picard group of X, one considers 
the group of isomorphism classes of certain metrised line bundles on X, as 
defined above. In [Fall], see also Chapters II, III and I of [Szp], Faltings 
extended Arakelov 's work by establishing results such as a Grothendieck- 
Riemann-Roch theorem in this context. Since then, Arakelov theory has 
been generalised by Gillet and Soule (see [Sou] and [Fal2]). Below, we will 
use the theory as given in [Fall] and Chapter n of [Szp]. We start with some 
preparations concerning Riemann surfaces. The aim of this subsection is to 
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give the arithmetic Riemann-Roch theorem as stated and proved by Faltings. 

Let X be a compact Riemann surface of genus g > 0. The space of holo- 
morphic differentials H°(X, $7^) carries a natural hermitian inner product: 

(4.4.1) {uj,ri) ^ ^ J^u Arj. 

Let (wi, . . . , Wp) be an orthonormal basis with respect to tliis inner product. 
This leads to a positive (1, l)-form jion X given by: 

^ 9 

(4.4.2) /i = — ^ Wfe A cJ^, 

^ k=l 

independent of the choice of orthonormal basis. Note that fx 1^ = 1- We 
refer to [Ara] for a proof of the following proposition. Denote by C°° the 
sheaf of complex valued (7°^ -functions on X, and by the sheaf of com- 
plex 1 -forms on X. Recall that we have a tautological differential op- 
erator d: — ^ It decomposes as d = d + d where, for any local C°° 
function / and any holomorphic local coordinate z, with real and imaginary 
parts X and y, one has df = i(|| - i^) ■ dz and df = + i^) ■ d:z. 

4.4,3 Proposition For each a in X, there exists a unique real-valued ga,fx ™ 
C°°(X — {a}) such that the following properties hold: 

1. we can write ga,fj. = log jz — z{a)\ + h in an open neighbourhood 
of a, where z is a local holomorphic coordinate and where h is a C°°- 
function; 

2. ddga,ij. = mn onX - {a}; 

3. jxga,nl^ = 0- 

We refer to /i and the ga^^i as the Arakelov (1, l)-form and the Arakelov- 
Green function, respectively. A fundamental property of the functions ga^f^ 
is that they give an inverse to the map — ^ A^, f i-^ {— 1/111)88 f, with 
A? the sheaf of complex C°° 2-forms on X, up to constants. For all / in 
C°°(X) we have: 

(4.4.4) f{x) = [ g{x,y) — {8df)y+ [ //Xx- 

JyeX TTZ Jx 
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For a proof of this see [Fall, pp. 393-394], or [Elk, Lemme 4]. 

We note that Stokes' theorem implies ga,n{b) = gb,nio,) for all a and b 
in X. The Arakelov-Green functions determine certain metrics, called ad- 
missible metrics, on all line bundles Ox{D), where D is a divisor on X, 
as well as on the holomorphic cotangent bundle Q,x- To start, consider 
line bundles of the form Ox {a) with a a point in X (the general case 
with D follows by taking tensor products). Let s be the tautological sec- 
tion of Ox (a), i.e. the constant function 1. We define a smooth hermi- 
tian metric |Hlox(a) on Ox (a) by putting log ||s||o^(„)(6) = gaA^) for 
any b in X. By property 2 of the Arakelov-Green function, the curvature 
form (27rz)~^551og(||s|p) of Ox{a) is equal to /x. To continue, it is clear 
that the functions ^a,/* can be used to put a hermitian metric on the line 
bundle Oxxxi^x), where is the diagonal on X x X, by putting 
log ||s||(a, 6) = ga,fi{b) for the tautological section s of Oxxxi^x)- 
Restricting to the diagonal we have a canonical adjunction isomorphism 
Oxxx{—^x)\ax ~^ ^x- define a hermitian metric ||-||Ar on Q,^ 
by insisting that this adjunction isomorphism be an isometry. It is proved 
in [Ara] that this gives a smooth hermitian metric on fi^, and that its curva- 
ture form is a multiple of /x. From now on we will work with these metrics 
on Ox (P) and (as well as on tensor product combinations of them) and 
refer to them as Arakelov metrics. Explicitly: for D = ^pUpP a divisor 
on X, we define gn^^ := ^pnpgp^^, and equip Ox{D) with the metric 
II -11 for which log ||1||((5) = gD,fj.{Q), for all Q away from the support of D. 
A metrised line bundle C in general is called admissible if, up to a constant 
scahng factor, it is isomorphic to one of the admissible bundles Ox{D), or, 
equivalently, if its curvature form curv(>C) is a multiple of /x. Note that then 
necessarily we have curv(>C) = (deg>C) • jjl by Stokes' theorem. 

For any admissible line bundle C, Faltings defines a certain metric on 
the determinant of cohomology A(£) = detH°(X,£) ® detYi^{X,CY 
of the underlying line bundle. This metric is the unique metric satisfy- 
ing a set of axioms. We recall these axioms (cf. [Fall], Theorem 1): 
(i) any isometric isomorphism Ci — ^ C2 of admissible Une bundles 
induces an isometric isomorphism \{C\) A(>C2); (h) if we scale 

the metric on £ by a factor a, the metric on \{C) is scaled by a fac- 
tor a^^^\ where x(>C) = deg>C — -I- 1 is the Euler-Poincare character- 
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istic of £; (iii) for any divisor D and any point P on X, the exact sequence 
^ Ox{D - P) ^ Ox{D) P^P*Ox{D) induces an isome- 
try \{Ox{D)) \{Ox{D - P)) ® P*Ox{D); (iv) for C = 0]^, the 
metric on \{C) = det H°(X, Q}^) is defined by the hermitian inner product 
(a;, rj) ^ (^/2) oj A fj on H°(X, O,^). In particular, for an admissible 
line bundle C of degree g — I, the metric on the determinant of cohomology 
A(£) is independent of scaling. 

It was proved by Faltings that we can relate the metric on the determi- 
nant of cohomology to theta functions on the Jacobian of X. Let Mg be 
the Siegel upper half space of complex symmetric y-by-y-matrices with 
positive definite imaginary part. Let r in Mg be the period matrix at- 
tached to a symplectic basis of Hi {X, Z) and consider the analytic Jacobian 
Jr{X) = C3/{Z3 + tZ9) attached to r. On one has a theta function 
-i?(z;r) = Z^jigzs exp(7ri*nrn + 2TTi^nz), giving rise to a reduced effec- 
tive divisor Qq and a line bundle 0(00) on Jr{X). Now consider on the 
other hand the set Picg_i(X) of divisor classes of degree g — 1 on X. It 
comes with a canonical subset 6 given by the classes of effective divisors. 
A fundamental theorem of Abel-Jacobi-Riemann says that there is a canon- 
ical bijection PiCp_i(X) Jt{X) mapping B onto Gq. As a result, we 
can equip PiCp_i(X) with the structure of a compact complex manifold, 
together with a divisor and a line bundle 0{@). 

The function i? is not well-defined on PiCg_i(X) or Jt{X). We can 
remedy this by putting 

(4.4.5) ||^||(^;r) = (detS>(r))V4exp(-7rV(5J(r))-^y)|??(z;r)|, 

with y = Q{z). One can check that descends to a function on Jt{X). 
By our identification PiCg-i{X) Jt{X) we obtain \\'&\\ as a function 
on PiCg-i{X). It can be checked that this function is independent of the 
choice of r. Note that gives a canonical way to put a metric on the line 
bundle 0(0) on Picg_i(X). For any line bundle C of degree g — 1 there 
is a canonical isomorphism from A(£) to 0(— 0) [£], the fibre of 0(— 0) at 
the point [C] in Picg_i(X) determined by C Faltings proves that when we 
give both sides the metrics discussed above, the norm of this isomorphism 
is a constant independent of £,; he writes it as exp{S{X)/8). In more ex- 
plicit terms, this means that for any line bundle £, of degree g—lonX with 
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h^(jC) = (and hence h^{C) = 0) we have: 

(4.4.6) \i£) = C, = eMS{X)/8y\\9\m). 

The invariant S{X) of X appears in the Noether formula, see below. 

We will now turn to intersections on an arithmetic surface. For us, an 
arithmetic surface is a proper, flat morphism p: X ^ B with X a regular 
scheme, with B the spectrum of the ring of integers 0;^ in a number field K, 
and with generic fibre a geometrically connected and smooth curve X/K. 
We say that X is of genus g if the generic fibre is of genus g. We will always 
assume that p is a semi-stable curve, unless explicitly stated otherwise. After 
extending the base field if necessary, any geometrically connected, smooth 
proper curve X/K of positive genus with K a number field is the generic 
fibre of a unique semi-stable arithmetic surface. 

An Arakelov divisor on is a finite formal integral Unear combination 
of integral closed subschemes of codimension 1 of X plus a contribution 
X^cr o^cr • running over the complex embeddings of K. Here a^r is a 
real number, and the symbols correspond to the compact Riemann sur- 
faces Xcr obtained by base changing X/ K toC via a. We have an M- valued 
intersection product (•, •) for such divisors, respecting Unear equivalence. 
When we want to indicate which model X is used for this intersection 
product, we will use the notation (•, Oa"- The notion of principal divisor 
is given as follows: let / be a non-zero rational function in K{X), then 
(/) = (/)fin + (/)mf with (/)fin the usual Weil divisor of / on X, and 
with (/)inf = ^^(/) • with v„{f) = - J^^ log \f\af^a- For a list of 
properties of this intersection product we refer to [Ara], [Fall] or Chapter 11 
of [Szp]. 

It is proved in [Ara] that the group of Unear equivalence classes of 
Arakelov divisors is canonically isomorphic to the group Pic{X) of isome- 
try classes of admissible line bundles on X. By an admissible line bundle 
on X we mean the datum of a line bundle C on X, together with admis- 
sible metrics on the restrictions of C to the X^. In particular we have 
a canonical admissible line bundle U;^; / ^ whose underlying line bundle is 
the relative dualising sheaf of p. In many situations it is convenient to treat 
intersection numbers from the point of view of admissible Une bundles. 

For example, if P : B — > is a section of p, and D is an Arakelov divisor 
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on X, the pull-back P*Ox (D) is a metrised hne bundle on B, and we have: 

(4.4.7) {D,P)=degP*Ox{D), 

where the degree deg of a metrised hne bundle is as defined in (4.3.1). As 

a second example, we mention that by definition of the metric on oj^/B' we 
have for each section P : B ^ X of pm adjunction formula: 

(4.4.8) iP,P + u;;^/B) = 0. 

For an admissible hne bundle £. on X, we have the notion of determinant 
of cohomology on B, in this context denoted by det Rp*>C (see Chapter n 
of [Szp]). By using the description above for its metrisation over the com- 
plex numbers, we obtain the determinant of cohomology on i? as a metrised 
line bundle. One of its most important features is a metrised Riemann-Roch 
formula (cf. [Fall], Theorem 3), also called arithmetic Riemann-Roch for- 
mula: 

(4.4.9) degdetRp*£ = ]^{C, C ® u~^^i^) -\- degdeip^ux /b 

for any admissible hne bundle Con X. 

The term degdetp^u}^ /s is also known as the Faltings height of X, the 
definition of which we will now recall. We let Jk be the Jacobian vari- 
ety of X, and J its Neron model over B. Then we have the locally free 
O^-module Coto(J) := 0*r2jyQ^ of rank g, and hence the invertible Ok- 
module of rank one: 

9 

00 J := /\0* Goto (J). 
For each a: K ^ Cv/e have the scalar product on C 'S/Qk given by: 
(a;|r?), = (V2)^(-l)^(^-i)/2 /■ ^ a ^. 

Jja(C) 

The Faltings height hxiX) is then defined to be the Arakelov degree of this 
metrised line bundle: 

(4.4.10) hK{X) = deg{uj), 

and the absolute Faltings height (also called stable Faltings height) ^abs(-'^) 
of X is defined as: 

(4.4.11) /tabs(^) = [K : Q]-' deg(a;j). 
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We remark that the stable Faltings height of X does not change after base 
change to larger number fields; that is why it is called stable. Therefore, 
^abs {X) can be computed from any model of X over a number field as long 
as that model has stable reduction over the ring of integers of that number 
field. 

As — > S is semi-stable, a result of Raynaud gives that the connected 
component of of J is the Picard scheme Fic^^^, whose tangent space 
at is R^p^:Ox- Therefore, Coto(J) is the same as p^tj, as locally free 
O/^-modules. A simple calculation (see lemme 3.2.1 in Chapter I of [Szp]) 
shows that, with these scalar products, ljj and detp*a; are the same as 
metrised O^-modules. Therefore we have: 

(4.4.12) hxiX) = deg(a;j) = degdetp^w. 

One may derive from (4.4.9) the following projection formula: let £' be a 
metrised Une bundle on B, and £ an admissible Une bundle on X. Then the 
formula: 

(4.4.13) degdetRp*(>C (8)p*E) = degdetRp*>C + x(>C) • deg£; 

holds. Here again xi^) is the Euler-Poincare characteristic of C on the 
fibres of p. 



bookarxiv March 23, 2010 



Chapter Five 



Computing complex zeros of polynomials and 
series 

J.-M. Couveignes 

The purpose of this chapter is twofold. We first want to prove Theo- 
rems 5.3.1 and 5.4.3 below about the complexity of computing complex 
roots of polynomials and zeros of power series. The existence of a deter- 
ministic polynomial time algorithm for these purposes plays an important 
role in this book. More importantly, we want to explain what it means for us 
to compute with real or complex data in polynomial time. All the necessary 
concepts and algorithms already exist and are provided partly by numer- 
ical analysis and partly by algorithmic complexity theory. However, the 
computational model of numerical analysis is not quite a Turing machine, 
but rather a real computer with floating point arithmetic. Such a computer 
makes rounding errors at almost every step in the computation. In this con- 
text, it is good enough to estimate the conditioning of the problem and the 
stability of the used algorithm. Statements about conditioning and stability 
tend to be local and qualitative. And this suffices to identify and overcome 
most difficulties and design optimal methods. 

Our situation however is quite different. We don't really care about effi- 
ciency. Being polynomial time is enough to us. On the other hand, we want 
a rigorous, unconditional and fully general proof that the algorithms we use 
are polynomial time and return a result that is correct up to a small error 
that must be bounded rigorously in any case. For this reason, we shall not 
use floating point registers: we don't want to worry about the accumulation 
of rounding errors. We rather decompose the computation in big blocks. 
Inside every block we only allow exact computations (e.g. using integers or 
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rational numbers). We also check that the function computed by every such 
block is well conditioned and we make a precise statement for that. Finally, 
we need to control the accumulation of errors in a chain of big blocks. But 
this shall not be too difficult because, since the blocks are big and efficient 
enough, the general organization of the algorithm is simple and involves few 
blocks. 

In Section 5.1 we recall basic definitions in computational complexity 
theory. Section 5.2 deals with the problem of computing square roots. We 
illustrate on this simple example what is expected from an algorithm in our 
context. The more general problem of computing complex roots of polyno- 
mials is treated in Section 5.3. Finally, we study in Section 5.4 the problem 
of finding zeros of a converging power series. 

Notation: The symbol in this chapter stands for a positive effective 
absolute constant. So any statement containing this symbol becomes true 
if the symbol is replaced in every occurrence by some large enough real 
number. 



5.1 POLYNOMIAL TIME COMPLEXITY CLASSES 

In this section we briefly recall classical definitions from computational 
complexity theory. Since we only need to define the polynomial time com- 
plexity classes, we shall not go into the details. We refer the reader to Pa- 
padimitriou's book [Pap] for a complete treatment of these matters. 

Turing machines are a theoretical model for computers. They are finite 
automata (they have finitely many inner states) but they can write or read 
on an infinite tape with a tape head. A Turing machine can be defined by 
a transition table. For a given inner state and current character read by the 
head, the transition table provides the next inner state, which character to 
write on the tape in place of the current one, and how the head should move 
on the tape (one step left, one step right, or no move at all). See [Pap, 
Chapter 2] for a formal definition. 

A decision problem is a question that must be answered by yes or no. 
For example deciding if an integer is prime. The answer of afunctional 
problem is a more general function of the question. For example factoring 
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an integer is a functional problem. If we want to solve a problem with a 
Turing machine, we write the input on the tape, we run the Turing machine, 
and we wait until it stops. We then read the output on the tape. If the 
machine always stops and returns the correct answer, we say that it solves 
the problem in question. The time complexity is the number of steps before 
the Turing machine has solved a given problem. Such a Turing machine is 
said to be deterministic because its behaviour only depends on the input. 
The size of the input is the number of bits required to encode it. This is 
the space used on the tape to write this input. For example, the size of an 
integer is the number of bits in its binary expansion. A problem is said to be 
deterministic polynomial time if there exists a deterministic Turing machine 
that solves it in time polynomial in the size of the input. The class of all 
functional problems that can be solved in deterministic polynomial time is 
denoted FP or FPTIME. The class of deterministic polynomial time 
decision problems is denoted P or PTIME. 

There exist other models for complexity theory. For example one may de- 
fine multitape Turing machines. There also exist random access machines. 
All these models lead to equivalent definitions of the polynomial complex- 
ity classes. An algorithm is a sequence of elementary operations and in- 
structions. Any algorithm can be turned into a Turing machine, but this is 
fastidious and rather useless since conceptual description of the algorithm 
suffices to decide if the number of elementary operations performed by the 
algorithm is polynomial in the size of the input. If this is the case, we say 
that the algorithm is deterministic polynomial time and we know that the 
corresponding problem is in PTIME or FPTIME. 

For example, if we want to multiply two positive integers N\ and N2, 
then the size of the input {Ni,N2) is the number of digits in Ni and N2 
and this is [log]^o(-^i + 1)1 + RogioC-^s + 1)1 ■ The number of elementary 
operations required by the elementary school algorithm for multiplication is 
6 X [log]^Q(iVi + 1)] X [log;^Q(A^2 + 1)1 ■ The constant here depends on the 
(reasonable) definition we have chosen for what an elementary operation is. 
We don't care about constants anyway. We say that the elementary school 
algorithm is deterministic polynomial time. There also exists a determinis- 
tic polynomial time algorithm for Euchdean division (e.g. the elementary 
school one). The extended Euclidean algorithm computes coefficients in 
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Bezout's identity in deterministic polynomial time also. So addition, sub- 
traction, multiplication and inversion in the ring Z jN'L can be performed in 
time polynomial in log N . The class a mod A^^ in "L/NIj is represented by 
its smallest non-negative element. We denote it aVoN. This is the remainder 
in the Euchdean division of a by N. 

A very important problem is exponentiation: given a mod N with 
< a < — 1 and an integer e > 1, compute mod N. 

Computing then reducing modulo N is not a good idea because cf 
might be very large. Another option would be to set ai = a and compute 
Ofc = (flfc-i X a) %N for 2 < A; < e. This requires e— 1 multiphcations and 
e — 1 Euchdean divisions. And we never deal with integers bigger than N"^. 
The complexity of this method is thus 6 x e x (log iV)^ using elementary 
school algorithms. It is well known however that we can do much better. 
We write the expansion of e in base 2 



So we can compute (a^)%iV at the expense of 6 x loge multiphcations 
and Euchdean divisions between integers < AT^. The total number of el- 
ementary operations is thus 9 x log e x (log N)^ with this method. So 
exponentiation in Z/NZ lies in FPTIME. This is an elementary but deci- 
sive result in algorithmic number theory. The algorithm above is called fast 
exponentiation and it makes sense in any group. We shall use it many times 
and in many different contexts. 

A first interesting consequence is that for p an odd prime and a an integer 
such that 1 < a < p — 1, we can compute the Legendre symbol 



at the expense of 0(logp)^ elementary operations. So testing quadratic 
residues is achieved in polynomial deterministic time. Assume now that we 
are interested in the following problem 



e = 



Q<k<K 



and we set bo = a and 



= bl_i%N fori <k<K. We then notice that 
= JJ bl^ mod N. 



0<k<K 
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Given an odd prime integer p, find an integer a such that 
1 < a < p — 1 and a is not a square modulo p. (★) 
This looks like a very easy problem because half of the non-zero residues 
modulo p are not squares. So we may just pick a random integer a between 
1 and p—1 and compute the Legendre symbol = . If the symbol 
is —1 we output a. Otherwise we output FAIL. The probability of suc- 
cess is 1/2 and failing is not such a big problem because we can rerun the 
algorithm: we just pick another random integer a. 

This is a typical example of a randomized Las Vegas algorithm. The 
behavior of the algorithm depends on the input of course, but also on the 
result of some random choices. One has to flip coins. A nice model for such 
an algorithm would be a Turing machine that receives besides the input, a 
long enough (say infinite) one-dimensional array TZ consisting of O's and 
I's. Whenever the machine needs to flip a coin, she looks at the next entry 
in the array TZ. So the Turing machine does not need to flip coins: we 
provide her with enough random data at the beginning. We assume that the 
running time of the algorithm is bounded from above in terms of the size of 
the input only (this upper bound should not depend on the random data TZ). 
For each input, we ask that the probability (on TZ) that the Turing machine 
provides the correct answer is > 1/2. The random data IZ takes values in 
{0, 1}^. The measure on this latter set is the limit of the uniform measures 
on {0, l}'^ when k tends to infinity. If the Turing machine fails to return the 
correct answer, she should return FAIL instead. 

We just proved that finding a non-quadratic residue modulo p can be done 
in Las Vegas probabilistic polynomial time. There is no known algorithm 
that can be proven to solve this problem in deterministic polynomial time. 
The class of Las Vegas probabilistic polynomial time decision problems is 
denoted ZPP. 

We now consider another slightly more difficult problem 

Given an odd prime integer p, find a generating set {gi)i<i<i for 
the cyclic group (Z/pZ)*. (★*) 
We have a simple probabihstic algorithm for this problem. We compute 
an integer / such that 



log2(31og2(p - 1)) < / < log2(31og2(p - 1)) + 2 



bookarxiv March 23, 2010 



100 CHAPTERS 

and we pick / random integers (ai)i<j</ in the interval [l,p — 1]. The 
are uniformly distributed and pairwise independent. We set gi = ai mod p 
and we show that the {gi)i<i<i generate the group (Z/pZ)* with probability 
> 2/3. Indeed, if they don't, they must all lye in a maximal subgroup of 
(Z/pZ)*. The maximal subgroups of (Z/pZ)* correspond to prime divisors 
of p — 1. Let q be such a prime divisor The probability that the {gi)i<i<i 
all lye in the subgroup of index q is bounded from above by 

1 1 

7-2^ 

so the probability that the {gi)i<i<i don't generate (Z/pZ)* is bounded 
from above by 2^^ times the number of prime divisors of g — 1. Since the 
latter is < log2(p — 1), the probability of failure is 

logab - 1) 
- 21 

and this < 1/3 by definition of /. 

Note that here we have a new kind of probabilistic algorithm: the answer 
is correct with probability > 2/3 but when the algorith fails, he may return 
a false answer. Such an algorithm (a Turing machine) is called Monte Carlo 
probabilistic. This is weaker than a Las Vegas algorithm. We just proved 
that problem can be solved in Monte Carlo probabilistic polynomial 
time. We don't know of any Las Vegas probabilistic polynomial time al- 
gorithm for this problem. The class of Las Vegas probabihstic polynomial 
time decision problems is denoted BPP. 

In general, a Monte Carlo algorithm can be turned into a Las Vegas one 
provided the answer can be checked efficiently, because we then can force 
the algorithm to admit that he has failed. Note also that if we set 

/=/+riog2(log2(p-l))l 

where / is a positive integer; then the probability of failure in the algorithm 
above is bounded from above by 2~f . So we can make this probability 
arbitrarily small at almost no cost. 

The main purpose of this book is to prove statements about the complexity 
of computing coefficients of modular forms. For example. Theorem 15.1.1 
states that on input a prime integer p, computing the Ramanujan function 
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t{p) can be done in deterministic polynomial time in log p. An important 
intermediate result is to prove that one can compute some Galois represen- 
tations modulo I in time polynomial in I. We shall present two methods for 
computing such representations. Both methods rely on computing approxi- 
mations. The first method computes complex approximations and leads to a 
deterministic algorithm. This is explained in Chapter 12 using the main re- 
sults in this Chapter 5. We also present in Chapter 13 a probabilistic method 
that relies on computations modulo small auxiliary primes. The main reason 
why the latter methods are probabilistic is that they require to find generat- 
ing sets for the Picard group of curves over finite fields. This is a general- 
ization of problem and solving it in deterministic polynomial time is 
out of reach at the moment. 



5.2 COMPUTEVG THE SQUARE ROOT OF A POSITIVE REAL NUMBER 

In this section, we consider the following problem: 

Given a positive real number a, 

compute the positive square root b = ^Ja of a. 

We need an algorithm that runs in deterministic polynomial time. This 
raises a few simple minded but important questions about what should be 
called an algorithm in this context. In Section 5.2.1 we try to formulate 
problem {-k-k-k) in a more precise way. We explain what is meant by an al- 
gorithm in this context, and which properties one would expect from such 
an algorithm. In Section 5.2.2 we present the classical dichotomy algorithm 
and check that it has polynomial time complexity. The notions presented 
in this section are classical and elementary and come from computational 
complexity theory [Pap] and numerical analysis [Hig, Hen]. The algorithms 
and methods we present are not original either, and they are far from opti- 
mal. We stress that our unique goal here is to prove that a polynomial time 
algorithm (in a sense that can be made rigorous) exists for some classical 
computational problem regarding real numbers. 
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5.2.1 Turing machines and real numbers 

We shall use deterministic Turing machines; as defined in [Pap, Chapter 2] 
for example. There is something annoying with problem however: 
both the input and the output are real numbers. Both existing computing 
devices and Turing machines only deal with discrete data. So they can't 
deal with real numbers. We may imagine a Turing machine or a computer 
handling registers with real numbers as in [Bl-Sh-Sm]. However, this would 
not be of great use to us, because we plan to perform computations on real 
numbers as an intermediate step in the computation of a discrete quantity: 
our basic idea is to compute an integer (having some arithmetic significance) 
from a good enough real approximation of it. In the end, we want a rigorous 
proof that the discrete information we are interested in can be computed by a 
deterministic Turing machine. We need to prove that a standard determinis- 
tic Turing machine can efficiently and safely compute with real and complex 
numbers, or at least with approximations of them. One possible approach to 
this classical problem is interval arithmetic as presented in [Hay]. We shall 
follow a slightly different track, which is better adapted to our situation. Our 
goal is to prove that a certain number of more or less elementary calcula- 
tions on complex numbers can be safely and efficiently performed (in a way 
that will be made more precise soon) by an ordinary Turing machine. These 
calculations include root finding of polynomials and power series, computa- 
tion with divisors on modular curves, direct and inverse Jacobi problems on 
these curves. In this section, the problem (★★*) will be used to illustrate a 
few simple ideas that will be applied more systematically in the sequel. The 
first question to be addressed concerns the input. 

What is the input of problem {-h^) ? 

Well, if a classical Turing machine is supposed to solve problem (irkrk) it 
cannot be given the real number a all at a time. That would be too big for 
her Instead of that, we assume that the Turing machine is given a black box 
BOXfl. On input a positive integer m, the black box BOX^ returns a decimal 
fraction Na x IQ-™- such that |a - A^a x 10""''^ | < 10""*'^. If the black 
box answers immediately, we will call it an oracle for a. A more realistic 
situation is that the black box answers in polynomial time. This means that 
on input a positive integer rua, the black box outputs the expected numerator 
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Na in time < Aama'^"- where Aa and da are positive integers depending on 
a but not on nia. We assume that a Turing machine calhng to a black box (or 
an oracle) must take the time to read and copy the integrality of the oracle's 
answer. For example, a Turing machine with an oracle for tt cannot access 
the 10^°° -th digit without reading the previous ones. 

In all the situations we shall be facing, there will be a Turing machine in 
the black box. However, not every real number can be associated with such 
a Turing machine: the set of Turing machines is countable and the set of real 
numbers is not. This is the theoretical reason for introducing black boxes 
there. 

What should be the output of a Turing machine solving problem (-k-k-k) ? 

Again, we don't expect the Turing machine to provide us with the real 
b = ^JH all at a time. We would be a bit embarrassed with it anyway. 
We rather expect the Turing machine, on input a positive integer m,\, and 
a black box for a, will return a decimal fraction iVj x 10""*'' such that 
|6 — AT^ X 10""*'' I < 10""*''. The square root Turing machine may call the 
black box for a once or several times. 

Altogether, the input of the square root Turing machine should consist of 
a black box BOXq for a and a positive integer m\) telling her the desired 
absolute accuracy of the expected result. And the output will be a decimal 
fraction approximating h. 

How do we define the complexity of a square root Turing machine ? What 
does it mean for such a Turing machine to be polynomial time ? 

Assume that we have a Turing machine SQRT that computes square roots. 
Assume that the input of the square root machine SQRT consists of a black 
box BOXa for a and a positive integer mi, (the required absolute accuracy 
of the result). We look for an upper bound for the number of elementary op- 
erations performed by SQRT, as a function of log max(a, 1) and m;,. Such 
a bound will be called a complexity estimate for SQRT. Notice that a call to 
the black box BOXa will be counted as a single operation. 

We assume that there exist two positive integers Asqrt and cJsqrt 
such that the complexity of SQRT is bounded above by a polynomial 
^sqrt('ti6 + logmax(a, 1))<^sqrt Then the number of calls to BOX^ is 
certainly bounded by this number. And the absolute accuracy required 
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from BOXa cannot exceed this number either, otherwise the machine SQRT 
would not even find the time to read the digits provided to her by BOXq. 
So by combining a black box BOXa for the input and the Turing machine 
SQRT, we obtain a black box BOX5 for the output b. And if both SQRT 
and BOXa have polynomial time complexity, so is the resulting black box 



Is problem well conditioned ? 

We have seen that the Turing machine SQRT cannot always access the 
exact value of the input a. Instead of that SQRT is provided with a black 
box that sends to her approximations of a. We want to make sure that a good 
approximation of 6 = ^/a can be deduced from a good approximation of a. 
Since the function a i-> y^is ^-Lipschitz on the interval [1, 00], we have 



as soon as a > 2 and | Aa| < 1. So a small perturbation of the input results 
in a small perturbation of the expected output in that case. One says that the 
problem is well conditioned. 

Not every computational problem is well conditioned. For example, com- 
puting the rounding function a 1— \a\ is not well conditioned if one gets 
close to i because the function is not even continuous there. 

We shall not need to formalize a definition of conditioning, but we shall 
check in several occasions that the function we want to evaluate is A- 
Lipschitz for a reasonable constant A. A weaker condition may suffice 
in some cases: for example, assume that we want to compute a func- 
tion a i-> 6 and assume that — logmin(l, |A6|) is lower bounded by 
(— logmin(l, |Aa|)) e for some fixed positive integer e. Then the loss of 
accuracy is polynomial in some sense: one can obtain m digits of b from 
Qrrf digits of a. 

For example, if we consider the problem of computing the square root of a 
positive real number a, we notice that the function a ^ ^fa is not Lipschitz 
on [0, +00 [ but we have 



BOXb. 




(5.1) 
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Aa 
1 + — 
a 



\Ab\ = \Va + Aa - s/al = -s/a x 

< Vo X v^A^ (5.2) 

whenever |Aa| < min(a,a^). 

So for small values of a, we loose (no more than) half the absolute ac- 
curacy when taking the square root. This is enough for us to say that the 
problem is well conditioned. 

5.2.2 The dichotomy algorithm 

Given a real interval [Mi, M2] and a continuous function 

/: [Mi,M2]^R 

such that /(Mi)/(M2) < 0, the dichotomy algorithm finds an approxi- 
mation of a real zero of / in [Mi , M2] . We use the dichotomy algorithm 
to compute the positive square root b = s/a of a positive decimal number 

a = Na X 10""^'" where Na > 1 and rua > are integers. So we call 
/ : [0, oo[— [0, oo[ the map x ^ x"^ — a. The algorithm below only han- 
dles integers and decimal fractions. Let h be the smallest integer such that 
10'* > Na- If n — rua is even we set M2 = 10 2 , otherwise we take 

h—ma-\-'l 

M2 = 10 2 . We set Ml = M2/IO. We assume that we are given also 
a positive integer (the required absolute accuracy of the result). 

We use two registers R\ and R2 containing decimal fractions. The initial 
value of Ri is Mi and the initial value of R2 is M2. 

The algorithm then goes as follows: 

1 . If / ( ^5i±52 ) is zero or if | i?i - ii:2 1 < 10-'"^ output ^^^^ and stop. 

2. If f{Ri)f{^^^) > 0, set Ri := and go to step 1. 

3. If f{Ri)f{^^^) < 0, set R2 ■- and go to step 1. 

The algorithm ouputs a decimal fraction b such that |6 — 6| < 10"'"''. 
The loop is not executed more than G(m(, + h — rua + 1) times. So the 
denominator of b is bounded above by io®('"a+'"6+'*+^) and the same holds 
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for any intermediate result in the course of the algorithm. So the complexity 
of the algorithm is polynomial in nia, log and mi,. And so is the size of 
the output. 

We now consider a few questions raised by this algorithm. 

What to do if the input a is a real number rather than a decimal one ? 

In that case, we assume that we are given a black box BOX^ for a and a 
positive integer rrih (the required absolute accuracy of the result). Our first 
task is to obtain from BOX„ a positive lower bound for a. So we first ask 
her for a decimal approximation of a within lO"^'^. If the answer is zero, 
we ask her for a decimal approximation of a within 10~^°. If the answer is 
zero again, we ask her for a decimal approximation of a within 10~^^. After 
a few steps, either we obtain a positive lower bound for a or we prove that 
a is smaller than 10"^"*'' . In the later case, we output 6 = which is a good 
enough approximation for h = y/a. 

The above shows that we can assume that we know the smallest positive 
integer s such that a is bigger than 10^''. 

Inequahties (5.2) and (5.1) show that if / > 2s and \a — a\ < 10~®' then 
— < 10~' for some absolute constant 6. So we ask BOXq for a 
decimal approximation a of a within iQ-^ii^b+^s+i) ^ ^ _ ^ 

6 = \/a and we check that \b — b\ < iQ-m-'^s-i^ ^^^^ ^.j^g decimal 

number a to the dichotomy algorithm above and ask it for an approximation 

of 6 = ^within 10-™6-i_ 

We obtain a decimal number b such that |6 — fe| < 10"'"''"^. We output b 
and check that 

|6 - 6| < |6 - 6| + |6 - 6| < 2 X IQ-"""-! < 10""^^ (5.3) 

So we have designed an algorithm (a Turing machine) that computes the 
positive square root of a positive number a in time polynomial in log (a + 1) 
and the required accuracy. 

Is the above algorithm stable ? 

People in numerical analysis say that an algorithm is stable when the 
value output by the algorithm is not too far from the exact value. As we 
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just proved, the dichotomy algorithm can compute b = y/a within 10^"*'' in 
time polynomial in log(a + 1) and > 1. So it can be said to be stable. 
We shall allow ourselves to use this terminology; but we prefer to state and 
prove clear and accurate complexity estimates like the one above. 

It is important to make a distinction between stabihty and conditioning. 
A problem can be said to be well conditioned. An algorithm can be said to 
be stable. In the above proof that the dichotomy algorithm for computing 
square roots is stable, we have used the fact that the problem itself is well 
conditioned. This is illustrated by inequality (5.3). 

5.3 COMPUTING THE COMPLEX ROOTS OF A POLYNOMIAL 

In this section, we consider the following problem: 

Given a degree d > 2 unitary polynomial with complex coeffi- 
cients 

P{x) =x'^ + ^ akx'^, 
0<k<d-l 

compute the complex roots of P{x). 

The input of problem (★★★★) consists of an integer d > 2 and a black box 
BOXp for the coefficients of P{x). On input a positive integer m and an 
index k such that < A; < d — 1, the black box BOXp returns a decimal 
fraction 



{Ni + N2i) X IQ-"'-^ such that \ak - (iVi + iV2i) x lO"'"-^! < lO-"* 

where i = G C. 

A Turing machine ROOTS solving problem (irkirk) should be given also 
a positive integer mz telling her the required accuracy of the result. Let 
Z = [zi] + [z2] + • • • + [zd] be the divisor of P. This is the formal sum 
of complex roots, counted with multiplicities. This is an effective divisor 
of degree d. On input a positive integer mz and a black box for the coeffi- 
cients of P{x), the machine ROOTS is expected to return an approximation 
Z = [zi] + [z2] H \-[zd]ofZ witiiin lO-'"^ . This means that there should 
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exist a permutation of the indices r G 5^ such that l-ZT-(fc) ~ ^ 10~"*^ 
for every 1 < k < d. 

The rest of this section is devoted to proving the following theorem. 

5.3.1 Theorem (Computing roots of polynomials) There exists a deter- 
ministic algorithm that on input a degree d unitary polynomial 

P{x) = x'^+ "fe^'' 

0<fe<d-l 

in €,[x\ md a positive integer mz, computes an approximation 

Z = [zi] + [Z2] + --- + [zd\ 

of the divisor 

Z = [Zi] + [Z2] + --- + [Zd] 

of P, within 10~"^^ . This means that there exists a permutation of the in- 
dices T e Sd such that |^;r(fe) ~ %| < 10~"*^ for every 1 < k < d. The 
running time is polynomial in d, log H and the requted accuracy mz > 1. 
Here H is the smallest integer bigger than the absolute value of all coeffi- 
cients in P{x). 

In Section 5.3.2 we prove that the problem is well conditioned in some 
sense. In Section 5.3.4 we recall the principles of Weyl's Quadtree algo- 
rithm. We recall in Section 5.3.5 that there exists an exclusion function 
that is sharp enough and easy to compute. This finishes the proof of Theo- 
rem 5.3.1. 

5.3.2 Conditioning 

Our first concern is to check that the problem of finding roots is well con- 
ditioned in some sense. We first need to define clusterings of roots. Let e 
be a positive real number. An e-clustering for P{x) consists of a positive 
integer K and a pair {ck,nk) for every 1 < k < K such that the following 
conditions are satisfied: 

• Cjt is a complex number and is a positive integer for every 
l<k<K. 
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• if fci / ^2 then \ck^ ~ | > 2e. 

• There are Uk roots of P{x), counting multiplicities, in the open disk 
D{ck,e/2) of center and radius e/2. 

• There are Uk roots of P{x) in the open disk D{ck, e), counting multi- 
plicities. 

• ^i<k<Krik = d. 

So we want to squeeze the complex roots of P{x) into small disks that are 
distant enough from each other. Note that there may not exist an e-clustering 
for every e. Problems may occur when the distance between two roots of P 
is close to e. However, for every positive e, there exists an e' such that 

2"'^'e <e <e (5.4) 

and an e'-clustering for P{x). Indeed, we consider the interval 

S= [-d^ log 2 + log e, lege] 

and for every pair {z,z') of distinct roots of P{x) we remove the interval 

[log |z — z'l — log 2, log \z — z'\ + log 2] 

to S. The resulting set T is not empty because there are at most d{d — l)/2 
pairs of distinct roots. Any e' such that log e' belongs to T is fine. 

Now, call Z = [zi] + [z2] H \- [zd] the divisor of P. We call A the 

smallest integer bigger than the absolute values of the coefficients of P{x). 
Let A(x) be a polynomial of degree < d — 1. Let S be the maximum of the 
absolute values of the coefficients of A(.t). We want to compare the roots of 
P and the roots of P + A. The absolute values of the roots of P are < dA. 
We fix an e < 1. We know that there exists an e'-clustering {ck,nk)i<k<K 
of the roots of P for some 2~'^^e < e' < e. Let z be a complex number 
such that |z — Cfcl = e' for some 1 < k < K. The absolute value of P{z) is 
lower bounded by {e')'^2~'^. On the other hand, the absolute value of A(z) 
IS upper bounded by dS{dA + 2e')'^~^ So if 
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we deduce from Rouche's theorem that P + A has roots inside D{ck,e'). 
As a consequence, the roots zi, Z2, Zd of P + A can be indexed in such 
a way that \zj — Zj\ < 2e' < 2e for every 1 < j < d. Roughly speaking, the 
meaning of inequality (5.5) is that when passing from coefficients to roots, 
the accuracy is divided by (no significantly more than) the degree d of the 
polynomial P. We thus have proven the following lemma. 

5.3.3 Lemma (Conditioning of the roots) There exists a positive constant 
6 such that the following is true. Let d > I be an integer and let P{x) 
he a degree d unitary polynomial with complex coefficients. Let A he the 
smallest integer higger than the absolute values of the coefficients of P. Let 
A{x) be a degree d—1 polynomial with coefficients bounded above by S in 
absolute value. Let e be the unique positive real such that 

logS = dloge-d log A-Od^. (5.6) 

Assume that e < 1. Let Z = [zi] + [Z2] + ■ ■ ■ + [z^] be the divisor of P 
and let Z = [zi] + [^2] + • • • + [zd] be the divisor of P{x) + A(x). There 
exists a permutation of the indices r G 5^ such that \zr(k) — < e for 
every 1 < k < d. 

This lemma tells us that if we are looking for an approximation within 
lQ-"^z of the divisor Z = [zi] + [Z2] + • • • + [zd] of a unitary polyno- 
mial P{x) G C[x] given by a blackbox BOXp, we may replace P by a good 
enough approximation of it having e.g. decimal coefficients. Indeed, we first 
compute the smallest integer A bigger than the absolute values of all coeffi- 
cients of P{x). We set e = I0~'^z-^ ^nd let 6 be the real number given by 
Equation (5.6). Let mp be the smallest integer such that 10""*^ < 6/d. We 
call the black box BOXp and obtain for every < k < d—1 a decimal frac- 
tion CLk with denominator 10™^'+1 such that |dfc — ak\< 10~™^ < 6/d. Let 
P = x'^ + X]o<fc<d-i (^kx''. We compute the discriminant of P. If it is zero, 
we replace P by P -I- 10""'"^ (we increase the constant term by 10~"*^.) If 
the discriminant is zero again, we add 10~"*^ to the constant term again. We 
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go on like that until the discriminant of P is non-zero. This process stops 
after d steps at most (seen as a polynomial in the indeterminate ao the dis- 
criminant has degree c? — 1, so it cannot cancel d times.) In the end we obtain 
a unitary polynomial P with decimal coefficients ak such that \dk — ak\ < S 
and the discriminant of P is non zero. If Z = [zi] + [22] + • • • + [zd] is 
the divisor of P, there exists a permutation of the indices t £ Sd such that 
\z^Q.-^ — -Zfcl < e for every 1 < k < d. The coefficients of P are decimal 
fractions with denominator \{f^p+^ where mp is an integer such that 



mp<Qd{mz + d^ + log A). (5.7) 

In order to approximate the roots of P within 10~"*^ it suffices to approx- 
imate the roots of P within 10~"*^~^. So in the sequel we shall assume 
that we are given a unitary polynomial with coefficients in Z[z, ^] having 
no multiple root. 

5.3.4 Weyl's Quadtree algorithm 

We now describe a simple-minded variant of the celebrated Weyl's Quadtree 
algorithm to compute complex roots of polynomials. Let 

0<k<d~l 

be a degree d>\ unitary polynomial with coefficients in So every 

coefficient au is a fraction Nk x 10^™'-^"-'^ with Nk = Ni^k+N2,ki and Ni^k, 
A^2,A; are in Z. We assume that ao is not zero. Let g be the smallest positive 
integer such that the distance between any two distinct roots of P is at least 
10~^. For every complex number z we denote by r{z) the distance between 
z and the closest root of P. We denote by R{z) the distance between z and 
the furthest root of P. Computing r{z) seems difficult unless one already 
knows the roots of P. However, we assume that we can compute for every 
z in ^] a decimal p{z) such that p{z) < r{z) < 1.01 x p{z). Such a 
p is called an exclusion function. We shall give in Section 5.3.5 an example 
of such an exclusion function that can be computed efficiently. 

We first construct a square Q in the complex plane C that is large enough 
to contain all roots of P. We take for Q a square with center the origin and 
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side length 

s = 2dA 

where A is the smallest integer bigger than the absolute values of all coeffi- 
cients in P. 

Now we divide Q into four squares of side lenght s/2: the top left square 
Qi, the top right square Q2, the bottom left square Q3 and the bottom right 
square Q4. For each 1 < A; < 4 we evaluate the exclusion function p at the 
center Ck of Qk. If p{ck) is bigger than the half diagonal s/(2\/2) of Qj- 
then we know that there is no root of P in Q^. So we erase this square. 

Next we consider all those squares that have not been erased and we di- 
vide each of them into four smaller squares with side length s/4. We eval- 
uate the exclusion function at the center of every such square. If the value 
of the exclusion function if bigger than the half diagonal s / (4\/2) of the 
square in question, we erase it. 

We go on like that, dividing all remaining squares into four smaller ones 
at each step. The number of remaining squares is never bigger than Ad. The 
reason is that a given root of P cannot compromise more than 4 squares at 
a time (such a situation would occur if the root in question were very close 
to the intersection of four contiguous squares). 

After n steps, the side length of the remaining squares is s/2". If s/2" 
is much smaller than the minimum distance between two roots of P, then 
there remains exactly d groups of contiguous squares, and they each contain 
a single root of P. So the number of steps is bounded by a constant times 



log(d^) + mz + g (5.8) 

where A is the smallest integer bigger than the absolute values of all coef- 
ficients in P, and mz is the required accuracy of the result, and 10~^ is a 
lower bound for the distance between any two roots of P. 

We illustrate this process on Figure 5.1. The two roots are represented by 
two bullets. 

Note that if the discriminant of P is non-zero, its absolute value is a least 
-|^Q-(mp+i)(2d-i) |.jjg distance between any two distinct roots is at least 
lQ-(mp+i)(2d-i)^2d^)-<^(''-i). We deduce 
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g < ed{mp + (f + dlog A). 

Combining this with the estimates in Equations (5.8) and (5.7) we deduce 
that the number of steps in Weyl's Quadtree algorithm is 



< e(f{logiA) + cf + mz) 



(5.9) 



where d is the degree of the polynomial, A the smallest integer bigger than 
the coefficients and mz the required accuracy for the roots of P(a;). 



Figure 5.1 Weyl's Quadtree method 

To finish the proof of Theorem 5.3.1 it remains to prove that there exists 
an exclusion function p that can be evaluated quickly enough. This is done 
in the next Section 5.3.5. 



5.3.5 Buckholtz inequalities 

In this section we recall useful inequalities due to Buckholtz [Bucl, Buc2] 
and we explain how to deduce a nice exclusion function following Pan 
[Pan]. Let P{x) = + Eo<k<d- 

.i^kX be a degree d > 2 unitary 
polynomial with complex coefficients. Assume that ao is not zero. Let 
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Z = [^i] + [^2] H 1- [-2d] be the divisor of P. For every integer v (positive 

or negative) we call 



the ?;-th power sum. Buckholtz has shown the following inequality 



1 , , (\Vv\\'^ , , 

- max \zJ\ < max — — < max \zJ. (5.10) 

5 l<'!;<d l<f<'^ V d J l<v<d 

One can easily deduce a more general and sharper statement. If M > 1 
is an integer then 



5 max IZyl < max — ; — < max \Zv\. (5.11) 

l<v<d l<v<d\ a J l<v<d 

Recall that for any 2 e C we call r(z) the distance between z and the 
closest root of P and R{z) the distance between z and the furthest root of 
P. From Equation (5.11) we deduce an estimate for R{0). 



max - — — < R(0) < 5m max - — . (5.12) 

l<v<d \ d J l<v<d \ d J 

If we apply inequaUty (5.12) to the reciprocal polynomial of P{x) we 
obtain 



5 m 1 
^ < r(0) < ^. (5.13) 

rv,Qv f W-Mv\ \ Mv (\V-Mv\\Mv 

maxi<„<(i I — 2 — ) maxi<„<(i I — ^ — I 

The power sum can be computed using Newton formulae. Assume 
that P{x) has coefficients ak = x 10""^^ with = Nk^i + Nk,2i and 
A^fc 1, A^fc 2 are in ^- Let A be the smallest integer bigger than the absolute 
values of the coefficients a^. Then computing i/y takes time polynomial in 
v,mp and log A 
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Extracting the ?;-th power of a decimal fraction N x 10^™ can be done 
in time polynomial in v, log A^, m and the required accuracy, using a di- 
chotomy algorithm as in Section 5.2. If M > 200 then the approximation 
factor 5 jv is smaller than 1.01. So we obtain a very sharp estimate for r(0). 

For any z G C we can apply inequahty (5.13) to the polynomial P{x + z) 
and obtain a good approximation of r{z). Assume that P{x) has co- 
efficients Qi = Ni X IQ-™^ with Ni = Ni^i + Ni^2i- Assume that 
z = (zi + Z2i) X 10^™^ and zi, Z2 are in Z. Let A be smallest integer bigger 
than the absolute values |aj|. Then, using Equation (5.13) for = 200 and 
the change of variable x t-^ x + z,v/e can compute a decimal number p{z) 
such that 

p{z) < r{z) < 1.01 X p{z) 
and this takes time polynomial in d,mp, log A, ruz, and 

log maxd^il, 1^21, !)• 

In the course Weyl's Quadtree algorithm, is the number of steps which 
is bounded in (5.9). Both \zi\ and \z2\ are bounded by d^lO"*"^. An upper 
bound for mp is given in (5.7). 

So the calculation of any value of the exclusion function that is required 
in the course of Weyl's algorithm takes polynomial time in d, log A and the 
required accuracy mz- This finishes the proof of Theorem 5.3.1. 

5.4 COMPUTING THE ZEROS OF A POWER SERIES 

Given a power series f{x) = /o + J2k>i fk^^ ^ '^[[^]] with positive radius 
of convergence R, we may want to compute the zeros of / inside the open 
disk D(0, R). However, the number of such zeros may very well be infinite. 
So we should restrict to a smaller disc D{Q, r) with < r < i?. Then it 
makes sense to wonder how many zeros there are in the disk -D(0, r) and try 
to compute approximations of these zeros. However, the problem of count- 
ing zeros in such a disk is not a well conditioned problem, because if / has 
a zero z of absolute value exactly r, then an infinitesimal perturbation of / 
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may push this zero inside or outside D{0, r). So we should allow the algo- 
rithm to choose a r' that is very close to r and compute the number of zeros 
inside D{0, r'). Then it makes sense to ask for approximations of these ze- 
ros. The input of a Turing machine ZERO computing zeros of power series 
would consist of a black box BOXj for the coefficients of f{x). On input 
an integer K > ^ and an integer m > 1, the black box BOXj returns for 
every Q < k < K a decimal fraction {Ni^^ + ^2,fcO ^ 10^™~^ such that 
l/fc - {Ni^k + A^2,fci) X 10-™-^ I < 10"™. Note that the Turing machine 
ZERO is not allowed to ask about one coefficient individually. In particu- 
lar, she needs at least time @k to receive any information about coefficient 
/fc from the black box BOX/. Unfortunately this is not enough for her to 
compute an approximation of the zeros, because there may appear a huge 
coefficient very far away in the development of /. If we want ZERO to 
be able to compute zeros without knowing all coefficients of the power se- 
ries, we should at least provide her with an upper bound for the coefficients 
in f{x). We introduce the following definition. 

5.4.1 Definition (Type of a power series) Let A> 1 be a real and n > 1 
an integer. A power series /(x) = /o + ^k>i fk^^ ^ 
{A, n) if for every A; > we have 



\h\<A{k + lT. 

The radius of convergence of a power series of type {A, n) is at least 1. El- 
ementary results about series of type [A, n) are collected in Section 5.4.17. 
The reader is advised to read quickly the results in this section before going 
further. We shall assume that the Turing machine ZERO is given two inte- 
gers a > 1 and n > 1 such that the power series f{x) is of type (exp(a), n). 

There is still one difficulty to overcome. For any finite set F C C we 
may consider the polynomial Pf{x) = O^gFl^ ~ divide Pf{x) 

by its norm we obtain a polynomial Q p (x) having all its coefficient 
bounded by 1 in absolute value. We may regard Qi;' as a power series of 
type (1,1). Since F can be arbitrarily large, we deduce that we cannot 
bound the complexity of finding zeros of a power series in a given disk 
-D(0, r) just in terms of the type {A, n) of the series. However, we guess that 
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a power series of type (1,1) having too many zeros inside a small compact 
set contained in its disk of convergence, must be small everywhere on this 
compact set. Also we shall assume that the Turing machine ZERO is given a 
lower bound for the maximum of / on -D(0, r). More precisely, we assume 
that 1/2 < r < 1 and provide the Turing machine with a positive integer n 
such that 1/(2;) I > exp(— ^) for at least one z in .0(0, 1/2). 
In this section, we shall prove the following theorem. 

5.4.2 Theorem (Counting zeros of a power series) Let 

/(^) = /o+E^^'^'C[M] 

k>l 

be a power series. Let a > 1 be an integer and set A = cxp(ri). Let n > 1 
be an integer such that f is of type {A, n). Let r be a real number such that 
1/2 < r < 1. Let fibe a positive integer such that there exists at least one z 
in D{0, 1/2) such that \f{z)\ > exp(-/i). 

The number of zeros of f in the closed disk D{0,r) is bounded by a 
polynomial in n, a, ji and (1 — r)~^. More precisely, there exists an absolute 
constant such that the number of zeros of f in the closed disk -D(0, r) is 
bounded above by 

6(n2 + fi + a)'^ 
(1 -r)i3 ■ 

We shall prove also the existence of an algorithm that computes approxi- 
mations of these zeros. 

5.4.3 Theorem (Approximating the zeros of a power series) There is a 
deterministic algorithm that on input an integer m > 1, an integer a > 1, 
an integer n > \, an integer ji > 1, a rational number r = 1 — l/o where 
o>2 is an integer, and a power series 

/(^) = /o + E^^'^'C[W] 
fe>i 

of type (exp(a),n), such that \ f{z)\ > exp(— /x) for at least one z in 
D (0,1/2) returns 
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• A rational number r' such that \r — r'\ < 10~™, 

• The number J of the zeros of f{x) in the closed disk D{0,r'), or 
equivalently the degree J of the divisor Z = [zi] + [22] + • • • + [zj] 
off restricted to the closed disk D{0, r'), 

• Assuming J > 1, for every 1 < j < J, a decimal 

where Mij and M2J are integers, such that 

Z = [zi] + [h] + ■■■ + [zj] 

approximates the divisor Z = [zi] + [Z2] + • • • + [zj] within 10"™". 
More precisely, there exists a permutation of the indices t & Sj such 
that \zT-(j) — Zj\ < 10"™ for every 1 < j < J. 

The algorithm runs in time polynomial in a, n, ji, o = {1 — r)"^, and m. 

Here is the main idea in the proof of these theorems. For every positive 
integer u we write f{x) = Pu{x) + Ru{x) where Pu{x) = Eo<fc<«-i fkx'^ 
is the principal part and Ru{x) = Ylk>u fkX^ remainder term of order 
u. We expect that if n is large enough, the roots of P«(x) in D(0, r) sharply 
approximate the zeros of f{x) in D(0, r). It would then suffice to apply the 
algorithm and theorem in Section 5.3. 

Our first concern will be to prove that the problem of finding zeros of a 
power series is well conditioned in some sense: a small perturbation does 
not affect too much the zeros. We cannot use Lemma 5.3.3 about the con- 
ditioning of roots of polynomials, and we cannot adapt its proof either, be- 
cause both the statement and the proof involve the degree of the polynomial. 
Instead of that, we shall first study the conditioning of every zero indepen- 
dently. In Section 5.4.4 we introduce the Newton polynomial of a power 
series and we show how it can help locating the zeros in the neighborhood 
of the origin. In Section 5.4.6 we deduce that if /(O) is very small, then f{x) 
has a zero in a small neighborhood of 0. This proves that a zero at the origin 
is well conditioned. In Section 5.4.8 we state and prove a simple effective 
version of the analytic continuation theorem. In the next Section 5.4.1 1, we 
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deduce that any zero of f(x) is well conditioned in some sense. A global 
statement about the conditioning of all zeros is stated and proved in Sec- 
tion 5.4.13. In the next Section 5.4.15 we use this result to finish the proof 
of Theorem 5.4.2. We give the proof of Theorem 5.4.3 and the correspond- 
ing algorithm in Section 5.4.16. Section 5.4.17 is devoted to the proof of a 
few elementary results about power series of type {A, n). 

5.4.4 The Newton polygon of a power series 

Let /(x) = 1 + Ylk>i fk^^ ^ '^[W] ^ ^ power series such that /(O) = 1. 
We assume that the radius R of convergence is positive (it might be infinite). 
Let r be a real such that < r < i?. We try to mimic non-archimedean 
analysis and relate the modulus of zeros of f{x) and the slopes of its Newton 
polygon. Let d be the degree of f{x) in the indeterminate x. So < d < oo 
and most of the time d = oo. The Newton cloud of f{x) is the subset of 
R X R consisting of couples (A;, — log \fk\) for all A; > such that fk 7^ 0. 
Let $ be the set of all affine functions ^ : [0, d] — > M whose graph stays 
below the Newton cloud: for every A; > one has 4){k) < — log The 
Newton function is a function J\f : [0,d\ defined as the sup of all in 
For every t e [0,d] 

M{t) = sup (j){t). 

This is a convex function on [0, d]. It is continuous and piecewise affine. 
Indeed, it is affine on the interval [k,k + 1] for every < k < d — 1. The 
Newton polygon is the set V = {ix,y) G [0,d] x M|AA(a;) < y}. The 
vertices of the Newton polygon are the points {k,M{k)) for all k where M 
is not differentiable (such a k must be an integer). This includes the point 
(0, 0), and the point {d,J\f{d)) also when d, is finite. The Newton polygon 
has a vertical edge ](0, +00), (0,0)]. If d is finite and non-zero, there is 
another vertical edge [{d,M(d)), (d, +00) [. The remaining edges connect 
successive vertices ofV.A slope of the Newton polygon is a slope of one 
of its edges. A supporting line is a fine L such that P is entirely contained 
in one of the two closed half planes determined by L, and L contains at 
least one point of V. For every element a in [—00, log R[ there is a single 
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supporting line La with slope a. If the Newton polygon has finitely many 
edges, then there also exists a supporting line with slope log R. If a is a 
slope of the Newton polygon, then La contains the corresponding edge of 
V. 

Assume that a G M is not a slope of the Newton polygon. The supporting 
line La contains a single vertex v = {k,Af{k)) of V. Let a~ G [— oo, +oo[ 
be the slope of the edge just before v. Let a"*" g] — oo, +oo] be 
the slope of the edge just after ij. The vector {—a, 1) is orthogonal 
to La- The Newton polygon V is contained in the closed half plane 
H = {{x,y)\i-a,l).{x,y) > (-a, A/'(A:))}. We deduce that for 
z a complex number such that log \z\ = a, the term f^z'' dominates the 
power series in some sense. Indeed, for every j > we have 



-\og\fjZ^ \ = -log|/j| - ja = {-a,l).{j,-log\fj\) 

>(-a,l).(fe,-log|/fc|) 

so fkZ^ has a bigger absolute value than any other term in the power series. 

Assume now that j > k. The point {j, — log \fj\) is above the support- 
ing line La+ with slope a+. So \ fj\ < |/fc|exp(— (j — Since 
log l^l = a, the term fjz^ has absolute value bounded above by 
times exp(— (j — A;)(q;+ — a)). The sum Ylj>k l/jll^P bounded 
above by times where a = exp(— (a"*" — a)). 

If j < k, then the point (j, — log|/j|) is above the supporting 
line La- with slope a~. So \fj\ < \fk\exp{—{k — j)a^). Since 
log|z| = a, the term fjZ^ has absolute value bounded above by 1/^1 jz]'^ 
times exp(— (fc — j){a — a^)). The sum J2j<k l/ill^P ^^^^ bounded 
above by lAH^l'^ times where b = exp(— (a — a^)). 

If + < 1 then the power series f{x) is dominated by the term 
fhz'' for \z\ = exp(Q;). We deduce from Rouche's theorem that f{x) has 
exactly k zeros inside D{0, exp(Q;)) counting muItipUcities. This is the case 
in particular if both a and b are smaller than |. We deduce the following 
lemma. 

5.4.5 Lemma (Newton polygon) Let f{x) = 1 + X]j.>i fkx^ he a power 
series. Let R > be its radius of convergence. Let z G D{0,R) be 
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a zero of f{x). There exists a slope a of the Newton polygon such that 
I log 1^1 — a\ < log 3. 

Let Vs be the set obtained by removing to] — oo, log i2[ all the intervals 
[a — log 3, cr + log 3] where a is any slope of the Newton polygon. 

If a real a belongs to Vz, then there is a unique vertex {k,J\f{k)) lying on 
the supporting line with slope a. The power series f{x) has exactly k zeros, 
counting multiplicities, inside the open disk D{0, exp(a)); and none on its 
boundary. 

Let Vi be the set obtained by removing to] — oo, log R[ all the intervals 
[a — log 4, (7 + log 4] where a is any slope of the Newton polygon. 

If a real a belongs to Va, then there is a unique vertex {k,M{k)) lying 
on the supporting Une with slope a. For any complex number z such that 
\z\ = exp{a), one has \ f{z)\ > ^ x \ fk\ x l^l*^. 

5.4.6 Conditioning of a zero at the origin 

In this section, we prove that a power series taking a very small value at the 
origin must have a very small zero. More precisely we prove the following 
lemma. 

5.4.7 Lemma (The smaller zero of a power series) Consider a power se- 
ries F{x) = Fq + X]jfc>i Fkx'^ e C[[x]] of type {A,n) where A > 1 is a 
real and n>l is an integer. Assume that \Fo\ < 1 and 

V-log|Fo| > e(n2 + logA). 

Then at least one of the following two statements holds true 

• F{x) has a zero ^ such that — log |^| > log |Fo|, 

• for every z in D{0, 1/2) the absolute value of F(z) is upper bounded 

by exp(-0.031v^-log|Fo|)- 

Before giving the proof of this lemma, let us sketch the main idea in 
this proof: if F is not small everywhere, there must be a coefficient in this 
series that is not too small. Since Fo is very small, the first finite slope 
in the Newton polygon must be very negative. But the lack of roots in 
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the neighborhood of and Lemma (5.4.5) force the Newton polygon to be 
smooth at the beginning: the many first slopes must keep very small. So 
the series has many huge coefficients, and it cannot be of type {A, n). A 
contradiction. 

So let F{x) be a power series of type {A, n) where ^ > 1 is a real and 
n > 1 is an integer. If Fq = then the first condition in the conclusion 
of the lemma is met and we are done. So we assume that Fq 7^ and we 
set f{x) = F{x)/Fq. If F{x) is constant, then the second condition in the 
conclusion of the lemma is met and we are done. So we assume that /(x) is 
not constant. The Newton polygon of f{x) has at least one finite slope. We 
call (To = —00, o"i, (72, . . . the successive slopes of the Newton polygon. 
If (Ji > then all coefficients fi are upper bounded by 1 in absolute value 
and the second condition in the conclusion of the lemma is met. So we may 
assume that a\ is negative. Recall the definition of Vz in Lemma 5.4.5 and 
consider the intersection P3n](7i,0[. If this intersection is not empty, we 
call p its infimum and set r = exp(/9). If the intersection is empty, we set 
/9 = and r = 1. 

We assume that the first condition in the conclusion of Lemma 5.4.7 is 
not met, and we show that in that case the second condition holds true. 

Since the first condition in the conclusion of Lemma 5.4.7 is not 
met, we know that all zeros of /(x) have absolute value bigger than 
exp(— -y/— log \Fq\). Using Lemma 5.4.5 we deduce that 



The interval ](Ti, log r[ does not meet V^. So it is contained in the union of 
the intervals [ai , ai + log 3] , [c72 - log 3 , (T2 + log 3] , [a^ - log 3 , (J3 + log 3] , 

[C74 - log 3, (74 + log 3], ... 

We deduce that all these intervals should adjust to tile all of [ai , log r] . 
So (72 < (Ti + 2 log 3, (73 < (72 + 2 log 3, . . . , (7fc < (7fe_i + 2 log 3 as long 
as (7fc_i < log r — log 3. So ak<ai + 2{k — 1) log 3 for every k from 1 to 
£ where 



-p = - 



log r < ./-loglFo 



(5.14) 



i = 



log r — ai 



(5.15) 



2 log 3 
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We deduce by summation that 



N{e) < (Ti + (72 + Vue,<iai + i{l-\) log 3. 



(5.16) 



where M is the Newton function of the power series f{x). 

From (5.15) we deduce tiiat I < and ai < logr - 2^ log 3. 

Reporting in (5.16) we obtain 



On the other hand, the power series F{x) is of type {A, n), so f{x) is of 
type (^/|Fo|, n). So the Newton function k i— > J\f{k) is lower bounded by 
the convex function — log A + log |Fo| — n log (A; + 1). We deduce 

N{t) > -log^+log|Fo|-nlog(^+l) > -log^+log|Fo|-n£ (5.18) 
From (5.17) and (5.18) we deduce 



In case i > n + logr we deduce from the inequality above that 
f{\og2,- 1) < log^ - log |Fo|. So 



N{e) < £logr-i^\og3. 



(5.17) 



£^ log 3 - (n + log r)£ + log \Fo\ - log ^ < 0. 




(5.19) 



We have made the assumption that 



V-log|i^o| > e{logA + n^). 



(5.20) 



From (5.19) and (5.20) we deduce 
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I < 3.2V-log|Fo|- 
From (5.15) we know that £ > ^f;^ - 1 so 



(5.21) 



(71 > -2^1og3-21og3 + logr. 
From (5.21) and (5.22) and (5.14) we deduce 



(5.22) 



<yi > -9V-log|Fo|. 
So for every A; > we have 



(5.23) 



li^fcl < |Fo|exp(-A;(7i) < |Fo| exp(9fev/- log |i^o| 



(5.24) 



This estimate will show very useful for small values of k. For bigger 
values of k, we use the fact that the power series F{x) is of type {A, n). 
Now we take some z G ^(0, 1/2) and we try to bound We set 



u 



^-\og\Fo\ 
10 



(5.25) 



and we check that u > (y^^2)'^ because of (5.20). 

We write F{x) = Pu{x) + Ru{x) where Pu{x) = J2o<k<u-i ^kx^ is 
the principal part and Ru{x) = ^fe>u Fj^x^ is the remainder term of order 
u. We now bound |-Pm(-z)| and separately. 

On the one hand, using Equation (5.24) 



\Pu{z)\< Yl 2-'=exp(log|Fo|+9(u- 1)7^1^^^) 



0<fc<'u-l 



^ log|Fo| 
<exp(^^). 

On the other hand, using Lemma 5.4.18 



(5.26) 
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\Ru{z)\ < n!A2-t+"+i < 2 



V-i°g|fol 



(5.27) 



21 



because of (5.20). 
Altogether we have 



\F{z)\ < |P„(2;)| + |i?„(2;)| <exp( 



log|i"o| 
10 



) + 2- 



V-l°8|J'0l 



21 



< 2- 



V-i°g|J'ol 



22 



using (5.26) and (5.27), then (5.20). This proves that the second condition 
in the conclusion of Lemma 5.4.7 is met. So the proof of this lemma is 



5.4.8 Analytic continuation of a power series of type {A, n) 

In this section we consider a power series f{x) = J2k>o fk^^ 
with ^ > 1 a real and n > 1 an integer. Let c be a complex number with ab- 
solute value smaller than 1 and let r be a real such that < r < 1 — | c| . The 
disk L>(c, r) is contained in .0(0, 1). We want to prove that if \ f{z)\ is very 
small for every z G D{c,r) then \f{z)\ is small for every z G D{0, 1/2). 
We shall need the following definition. 

5.4.9 Definition (Balanced disk) Let D{c,r) be a disk contained in the 
unit disk D{0, 1). We say that D(c, r) is balanced if r = i^^^. The mean- 
ing of this condition is that the distance between D{c, r) and the unit circle 
is equal to the radius of D(c, r). If this condition is met, the circle D{c, r) 
is denoted Dc. 

Assume further that |c| > ^ and set d = (|c| — §) x ]ff- Let Dc' 
be the balanced disk with center c'. The radius of Dc' is r' = |r and 
1 - = 1(1 - |c|). We say that Dc' is the son of Dc- 

If |c| < ^, then the son of Dc is defined to be -D(0, 1/2). 

The following lemma states that a power series of type {A, n) that is very 
small on a balanced disk, must be small also on the son of this disk. 

5.4.10 Lemma (Analytic continuation) Let f{x) = Yl,k>ofkX^ ^ 

power series of type {A, n) where A > 1 is a real and n > 1 is an in- 
teger Let c be a complex number with absolute value smaller than 1 and 



finished. 



□ 
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Figure 5.2 Son of a balanced disk 



1— Id 

let Dc be the balanced disk with center c. Call r = the radius of 
Dc. Let Dc' be the son of Dc- Let e be a real number in ]0, 1[ such that 
— loge > 6(log^ + n(n + ] logr|)). Assume that \ f{z)\ < e for every 
z G Dc. Then \ f{z)\ < es for every z G D^.'. 

In order to prove this lemma we observe that the disk D{d,r/2) is con- 
tained in Dc- So the absolute value of / is bounded by e in D{c',r/2). 
Cauchy's integral formula then gives an upper bound for the successive 
derivatives of / at c/. 



2^k\ 

< e—^. (5.28) 

In order to bound \ f{z)\ for z £ D^,' we call T{x) = ^^.>o 
the Taylor expansion of / at c'. We choose an integer n > and write 
T{x) = Pc',u{x) + Rc',u{x) where Pc',u{x) = Eo<fc<M-i ^-T^^'' the 
principal part and Rc\u{x) = X^jt>„ ^—w^x^ is the remainder term of 
order u. Any z in the son D^' can be written z = d + t whith |i| < r' = ^. 
We now bound |Pc',w(i)| and \Rc',u{i)\ separately. 

On the one hand, using Equation (5.28) we obtain 



|/('=)(c')| 



(2i7r) 



|C|=r/2 



f{d + C) 
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iPc>(t)i< Yl 



0<k<u-l 



V I'—Y — 

0<fe<M-l 



^'2 



(5.29) 



On the other hand, we set t = {l — \(^\)y and z = c' + t = c' + (1 — |c'|)y. 
The remainder — W\)y) is nothing but the remainder of order u 

of the refocused^ power series y ^ fc'iu) = /(c' + (1 — |c'|)y). Since 
z = c' + y{l — \c'\) belongs to the balanced disk Dc' we know that y 
belongs to D{0, 1/2), the balanced disk with center 0. So \y\ < 1/2. We 
now apply the refocusing Lemma 5.4.19 together with Lemma 5.4.18. 

The refocusing Lemma 5.4.19 tells us that fc' has type {A',n + 1) where 
A' < nlA (^jzf^y^^ < n\A (f Lemma 5.4.18 applied to the refo- 
cused series fc' then says that 



\Rc',u{t)\<A"{u + l'r+'2-'' 



where 



(5.30) 



A" <{n + l)\n\A[ — \ < Aexp(Kn(n + | logr|)) (5.31) 



for some positive constant K. 



We set u 



1 log A 

2 log I 



. From (5.29) we deduce 



1 I / M , , 5 , I log el , 5 

log \Pc',u{t)\ < log e + log - < log e + + log - 

< 0.49 log e 



(5.32) 



using the hypothesis 



■ loge > G(log^ + n{n + \ logr|)). 



(5.33) 



'The refocused series is defined in section 5.4.17 
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As far as the remainder is concerned we obtain from (5.30) and (5.31) 
that log \Rc',u{t) \ is 

< log ^ + Kn{n + I log r I) + (n + 1) log(u + 1) - « log 2. (5.34) 

We show that the negative term —u log 2 dominates this sum. First of all, 
from the definition of u and the hypothesis (5.33) we deduce that 

log A + Kn{n+ |logr|) < 0.01 x nlog2. 

The same hypothesis (5.33) implies that 

- VO-01 X iog2y 

so 0.01 X u log 2 > (n + 1) > (n + 1) log{u + 1). Inequality (5.34) then 
implies 



0.98 log 2 
2 log I 

From (5.32) and (5.35) we deduce that if z G Dc' and z = cf +t then 



log\Rc'u{t)\ <-ux 0.98 log 2 < T-loge < 0.37 log e. (5.35) 

2 log I 



log\f{z)\=log\Pc',u{t) + Rc',n{i)\ 

<log (2max(|Pe',u(i)|,|i?c',«(i)l)) 
loE e 

<log2 + 0.37 log €< (5.36) 

This finishes the proof of Lemma 5.4.10. We notice that the exponent ^ 
in the conclusion of this lemma could be replaced by any real smaller than 

5.4.11 Conditioning of any zero 

In this section we combine Lemma 5.4.7 and Lemma 5.4.10 to prove that 
any zero of a power series is well conditioned in some sense. In other words, 
we prove that a power series taking a very small value at some point c inside 
its disk of convergence, must have a zero that is very close to c. More 
precisely we prove the following lemma. 
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5.4.12 Lemma (Conditioning of a zero) Let 

fe>i 

be a power series of type {A, n) where A > 1 is a real and n > \ is an 
integer. Let c G -D(0, 1) be a complex number with absolute value smaller 
than 1. Assume that |/(c)| < 1 and 

(1 - \c\f X V- log |/(c)| > &{n^ + log^). (5.37) 
Then at least one of the following two statements holds true 



• /(x) has a zero ^ such that — log |^ — c| > y^— log |/(c)|, 

• for every 2; in D(0, 1/2) the absolute value of f{z) is upper bounded 
by 



exp 



(1- k-^D' X v^-iog|/(c)| 
100 



Indeed, let fdy) = f{c + y(l — |c|)) be the refocused series of / at c. 
According to Lemma 5.4.19, it has type {A', n + 1) where 



log(A') < log l^nU ^^-^^ j j < iC(n^ + logA + n|log(l- |c|)|) 

<K(n2 + logA + — ^) (5.38) 

1 — |c| 

where K is a positive constant. 

We now apply Lemma 5.4.7 to fc- From inequality (5.38) and the hy- 
pothesis (5.37) we deduce that fc satisfies the hypothesis in Lemma 5.4.7. 
We deduce that one at least of the two following conditions is met: 



• Either fc has a zero yo such that log \yo\ < —y/— log |/(c)|, in which 
case we call ^ = c + yo(l — |c|) the corresponding zero of /. And we are 
done, because |C — c| < \yo\. 
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• Otherwise, \ fc{y)\ is bounded by exp(— 0.031 x a/— log |/(c)| ) for any 
y in D{0, 1/2). Equivalently, f{z) is bounded by 



exp(-0.031 X V-log|/(c)|) 

for any z in the balanced disk with center c and radius (1 — |c|)/2. In 
that case, we apply Lemma 5.4.10 several times. Indeed, we set 



w 



log(l - \c\ 
log I 



and apply w times Lemma 5.4.10. 

We conclude that for every z G D{0, 1/2), the absolute value of f{z) is 
bounded by 



exp(-0.031 X 3-"" X V- log |/(c)| ). 



Since 



_ log3 

3"' < 3(1- |c|) < 3(1- |c|)-^ 
we find that / is bounded in absolute value by 

exp(-0.01 X (1 - \c\f X V-log|/(c)|) 

onL>(0, 1/2). 

Of course, we must check that the hypothesis of Lemma 5.4.10 are satis- 
fied every time we apply it. This is the case if 



(1 - \c\f X V-log|/(c)| > e(log A + nin + \ log(l - |c|)|). 
We conclude using the hypothesis (5.37) and the fact that 

|log(l-|c|)|<(l-|c|)-^ 



□ 
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5.4.13 Global conditioning of zeros 

In this section, we apply Lemma 5.4. 12 to several zeros at a time and evalu- 
ate the conditioning of the divisor of zeros of a power series. The following 
lemma states that the zeros of a power series can be approximated by the 
zeros of its principal part. 

5.4.14 Lemma (Global conditioning of the zeros) Let 



be a power series of type (A, n) where A > 1 is a real and n > 1 is an 
integer. Let r and p be two real numbers such that 1/2 < r < 1 and 
< p < 1. Assume 



and u < — ■ vbean integer such that the two following conditions 
hold true 

• For any integer w such that v <w and w < u — 1, the coefficient fw 
is bounded in absolute value by exp(— 6(log p)^). 

Note in particular that v = u is fine. 

Then for every z in D{0, r), the remainder Ry{z) of order v is bounded 
in absolute value by exp(— 4(log p)^) 



f{x) = fo + J2fkx'eC[[x]] 



(1 - rf X |logp| > e(n^ + log^). 



(5.39) 



Let ubean integer such that 



u > 




|i?„(z)| <exp(-4(logp)2), 



(5.40) 



and at least one of the following two statements holds true 
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• for every z in D{0, 1/2) the absolute value of f{z) is upper bounded 
by 

exp (O.Ol X (1 - rf x logp) , 

• there exists a positive real R such that r — p < R < r and such that, 
inside the disk D{0, R), the zeros of f{x) are approximated within 
p by the zeros of its principal part Pv{x) = X]o<fc<i)-i fk^^- 1^ 
particular, the number J of these zeros (counting multiplicities) is at 

mostv—1. More precisely, letZ = [zi] + [z2]-\ be the divisor 

of fix) restricted to D{0, R), and let Z = [zi] + [Z2] H h [zj] be 

the divisor of Py {x) restricted to D{0, R). Then, either J = 0or there 
exists a permutation of the indices t e Sj such that l^^r^) ~ %l ^ P 
for every 1 < j < J. 

We can be a bit more explicit about the real R above. Any R such that 
Re [r — p,r] and\R—\z\\ > 2p^ for every root z of Py{x) is fine. 



The meaning of this lemma is that the zeros of f{x) are well approxi- 
mated by the zeros of a well chosen truncation of f{x). The lemma tells 
us where the series should be truncated, depending on the required absolute 
accuracy: if we want m digits of accuracy, we need to consider the rn^ first 
terms in the series. One may wonder why we have introduced the integer v. 
The point is that if for the given integer u, the coefficient /„ is very small, 
then we can ignore it and truncate a bit earher. This freedom will be used to 
ensure that the leading coefficient in Py (z) is not too small. Then, we can 
normalize Pv{z) and apply Theorem 5.3.1 of Section 5.3. It is important to 
normalize because Theorem 5.3.1 only applies to unitary polynomials. 

Now let us prove Lemma 5.4.14. 

Let e = exp(— 4(logp)^). Using Lemma 5.4.18 we prove that Ru{z) is 
bounded in absolute value by e/2 for any z in D{0, r). Indeed, the hypoth- 
esis u > pog"^|)2 in Lemma 5.4.18 results from Equation (5.39) and the 
definition of u. Equation (5.46) then gives 
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log \Ru{z)\ < + log A + - (n + 1) log(l - r) 

< + log A - 8(log pf - (n + 1) log(l - r) 

from the definition of u. 
Using (5.39) we deduce 

log\Ru{z)\ < -7(logp)2 < - log 2 + log e. 
We check that 

u< (5.41) 

1 — r 

< G(log pf^'^ because of (5.39). 
Now, we prove that Rv{z) is bounded in absolute value by e. Indeed 

\Rviz)\ < \Ruiz)\ + {u-v) exp(-6(log/9)2) 

< e/2 + 6(log p)^"'"5 exp(-6(log p)^) using equation (5.41), 

< e/2 + exp(-5(log/9)^) because of (5.39), 
<e. 

The principal part Py (x) is a degree f — 1 polynomial. It has no more than 
u— 1 zeros. From Equation (5.41) we deduce that up < ep2(logp)2+6. So 
4up^ < p using (5.39). In particular 4up^ is smaller than r and smaller than 
p. The interval [r — p, r] then consists of positive reals and must contain at 
least one real number R such that | — | z 1 1 > 2p^ for every root z of P„ (x ) . 
We fix any such R. 

Let U be the union of all open disks D{^,2p'^) where ^ is any root of 
Pv{x) lying in D{0,R). We check that U is contained in D{0,R). Let 
V = D{0,R) - U. It is clear that P^{x) has no root in V. 

• We first assume that |-P^ (2) | > e for every z on the boundary of T>. We 
apply Rouche's theorem to 5(0, R) and deduce that f{x) and Pv{x) have 
the same number of zeros with absolute value < R. 
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Now let V be any connected component of U. The boundary of V is 
contained in the boundary of V. Applying Rouche's theorem to V we de- 
duce that f{x) and Pv{x) have the same number of zeros in V. Since V 
is the union of a number < v oi closed disks of radius 2p^, we know that 
its diameter is < Aup^. We deduce that the zeros of Pv{x) inside -D(0, R) 
approximate the zeros of f{x) inside -D(0, R) within Aup^ < p. More pre- 
cisely, let Z = [zi] + [z2] + • • • + [zj] be the divisor of /(.x) restricted to 
L'(0, R). Then the divisor Z of Pv{x) restricted to -D(0, R) has degree J 

also. Assume that J > 1 and let Z = [zi] + [Z2] H h [zj] be the divisor of 

Pv{x) restricted to D{0,R). Then there exists a permutation of the indices 
T e Sj such that |2r(i) ~ %l ^ P for every 1 < j < J. So the lemma is 
proven in that case. 

• We now assume that |-Pr,(C)| < e for some ( on the boundary of 
v. Since \(\ < r and P„(x) has no zero in D{(,p^), we deduce, using 
Lemma 5.4.12, that Pv{z) is bounded by 

exp(-0.01 X (1 - r)^ X I log p^|) = exp(0.02 x (1 - rf x logp) 
for every z G D(0, 1/2). So for every such z we have 



In the next two Sections 5.4.15 and 5.4.16 we use Lemma 5.4.14 to prove 
Theorem 5.4.2 and Theorem 5.4.3. 

5.4.15 Counting zeros of power series 

We now can give a proof of Theorem 5.4.2. 

Let K he a large enough positive constant and let < p < 1 be the 
unique real number such that 



\f{z)\ < \Pv{z)\ + \Rv{z)\ < exp(0.02 x (1 - rf x logp) + e 
< exp(0.01 X (1 - r)^ x logp) 



and the lemma is proven in that case. 



□ 



log p| X (1 - rf = K{fj, + n'^ + log A). 



(5.42) 



bookarxiv March 23, 2010 



COMPUTING COMPLEX ZEROS OF POLYNOMIALS AND SERIES 



135 



We set r' = (1 + r)/2 and check that 1 - r' = (1 - r)/2. We apply 
Lemma 5.4.14 to the series /(x) over the disk D{0, r'). 

It is clear that condition (5.39) is satisfied provided K is large enough. 
We note also that 



We set w = u and observe that, provided K is large enough, the first 
conclusion in Lemma 5.4.14 is not compatible with the definition of p given 
by Equation (5.42). Therefore, the second conclusion in Lemma 5.4.14 must 
hold true: there exists an R such that r' — p < R < r' and the number of 
zeros of f{x) inside -D(0, R) is bounded by u. If K is large enough then p 
is smaller than r' — r = (1 — r)/2. So D{0, r) C .0(0, R) and the number 
of zeros in D{0, r) is bounded by u. □ 

5.4.16 An algorithm for imding zeros of power series 

In this section we describe the algorithm announced by Theorem 5.4.3 for 

computing the zeros of a power series f{x). The input of the algorithm is 
described in the statement of Theorem 5.4.3 and at the beginning of Sec- 
tion 5.4. We are given a black box BOXj for the coefficients of f{x). We 
are given two integers a > 1 and n > 1 such that f{x) is of type {A,n) 
where A = exp(a). We are given also an integer p> 1 such that there ex- 
ists at least one z in Z)(0, 1/2) such that \ f{z)\ > exp(— //). We don't need 
the value of this z. Knowing its existence suffices. Finally, we are given 
two integers m > 1 and o > 2 and we are supposed to compute approx- 
imations within 10"™ for the zeros of f{x) in some disk D(0,r') where 
\r' — r\ < 10""* and r = 1 — l/o. 

Let if be a large enough constant. We assume that if is an integer. We 
set 



We apply Lemma 5.4.14 to the series f{x) over the disk Z)(0,r) with 
the accuracy p' . It is clear that condition (5.39) is satisfied provided K is 



u < 



16(logp)^ _ 16if^(/x + n^ + log^)^ 
l-r' ~ (1 - r'Y^ 



m! = K{m + {p. + n^ + a)o^) and p' = exp(— m'). 



(5.43) 
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large enough. It is clear also that the first conclusion in this lemma is not 
compatible with the definitions of and m' . So the second conclusion must 
hold true. We take for u the value 



1 — r 

We first show that there exists at least one integer w such that 1 <w <u 
and > IQ-^K)'. Otherwise, for any z G -0(0, 1/2) we would have 

\f{z)\<\Puiz)\ + \Ruiz)\ 

< ulO-^("')' + exp(-4(logp')^) using equation (5.40) 

< exp(-//) 

using the definition of p' in (5.43) and assuming K is large enough. But the 
later inequality contradicts the hypothesis on ij, in Theorem 5.4.3. 

So let V be an integer such that 1 < v < u and \fv~i\ > 0.5 x 10~^(™')^ 
and \ fw\ < 10~^*^™'^^ for all w such that w > v and w < u — 1. Let R be 
any real such that i? G [r — p',r] and \R — \z\\ > 2(p')^ for every root z of 
Py{x). Then, inside the disk D{0, R), the zeros of Pv{x) approximate the 
zeros of f{x) within p'. If K is large enough then p' < 0.5 x 10~"*. 

We call P{x) = Py{x)/ fv-i the unitary polynomial associated with 
Pv{x). Its coefficients are bounded above by 2ylt;"10^('"')^. So we can 
compute approximations {c(j)i<j<v~i of the roots of P{x) within (p')^ us- 
ing the algorithm provided by Theorem 5.3.1 of Section 5.3. We assume 
that the aj are sorted by increasing absolute value. We consider the interval 
[r — p\r] and we remove to it all intervals \\aj\ — 3(p')^, \aj\ + 3(/9')^]. 
Let r' be a rational number in this set. We count the aj that belong to 
the disk £)(0, r'). Assume that there are J of them. We output the divisor 
[ai] + [02] ^ h [aj]. 

This leads to the following algorithm: 



1. Set 

m' = K{m + o^{ii + n^ + a)) and u = l&K'^o{m + o^{ii + n^ + a)Y 
and look for an integer v such that 
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I <v <umd > 0.5 X 10-6(™')' and |/^| < IQ-^^'"')" for 



all w such that w > v and w < u — 1. 

2. Using the algorithm provided by Theorem 5.3.1, compute approx- 
imations {aj)i<j<y-i of the roots of P{x) = Py{x)/ fy-\ within 
exp(— 2m'). 

3. Pick a rational number r' in the set 

[r — exp(— m'),r] — Uj[l<^jl ~ 3exp(— 2m'), \aj\ + 3exp(— 2m')]. 

4. Output r' and those Uj that have absolute value < r'. 
5.4.17 Power series of type {A, n) 

In this section, we review simple elementary results about power series in 
one variable. Recall Definition 5.4.1 of the type of a power series in one 
variable and let f{x) = ^fc>o fkx^ be a power series of type [A, n) with 
^ > 1 a real number and n > 1 an integer. Let u > be an integer. 
We write f{x) = Pu{x) + Ru{x) where P„(x) = X)o<fc<«-i 
principal part and Ru{x) = X^fc>„ fk^^ is the remainder term of order u. 
We first want to bound \Ru{z) \ for z e D{Q, 1). 



k>u k>u 



<A^(A; + l)"|z 



k>u 



<^|z|"^(/fc + u + l)"|z 



fe>0 



<A|z|"(u + l)"^(A; + l)"|z 



fe>0 



(5.44) 



We set 



(5.45) 



(1 - |z|)"+i 
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„2 



and we show that \Ru{z)\ < k provided u > jj^j^^- Indeed, if 
u > jj^^ then nlog(ti + 1) < n^^ < so 



111 , / -,\ ^ilogbl 
■ulog \z\ + nlog('u + 1) < 



Using (5.44) we deduce 

U lo^ \z\ 77- ^ 

log \Ru{z)\ < log ^ + + log _ = 

We thus have proven the following lemma. 

5.4.18 Lemma (Bounding the remainder of a power series) Let f{x) he 

a power series of type {A, n) where A > 1 is a real number and n > 1 is 
an integer. Let z be a complex number such that \z\ < 1. Let u > be an 
integer and let Ru{x) = Z^fc>„ fkx^ be the remainder of order u of f{x). 
We have 



\Ru{z)\<A\z['{u + lY 



(1 - 



and if u > '^"i \V2 then 



Note that if we set tt = in (5.44) we obtain 



Now let f{x) be a series of type {A, n) and let c be a complex number 
such that |cj < 1. We set fc{x) = f{c+x{l — |c|)) and call /c the refocused 
series of f{x) at c. We want to bound the coefficients of the power series 
fc{x). These coefficients are related to the successive derivatives of / at c. 
Let A; > be an integer. We set 
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{k + 1) + (n + l)\c\ 



k + n + 2 



From Cauchy's integral formula 



\f^'\c)\ 



k\ 



/(C) 



\C\=p 



(C - c)* 



-dc 



<n\k\A 



ik + n + 2)*^+"+2 



{k + 1)'=+Hn + 1)"+^ (1 - |c|)"+'=+2 



using (5.47). 
We notice that 



(5.48) 



{k + n + 2)*^+"+2 



< 1 + 



1 + 



<exp(n + l)2"+i(A; + l)"+\ 



n + l) 



(5.49) 



From (5.47) and (5.49) we deduce that the refocused power series fc{x) 
has type 



{n\A{l 



-n-2 



exp(n + l)2"+\n + 1). 



We thus have proven the following lemma. 

5.4.19 Lemma (Refocusing a power series in one variable) Let 

fix) e C[[x]] 

he a power series of type {A, n) where A > 1 is a real and n > 1 is an 
integer Let cbe a complex number with absolute value smaller than 1. The 
refocused series fc{x) is defined as fc{x) = f{c + — |c|)). Itis apower 
series of type {n\A{l — \c\ 



-n-2 



exp(n + l)2"+\n + 1) 
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Chapter Six 



Computations with modular forms and Galois 
representations 

J. Bosman 

In this chapter we will discuss several aspects of the practical side of com- 
putating with modular forms and Galois representations. We start by dis- 
cussing computations with modular forms and from there on work towards 
the computation of polynomials associated with modular Galois representa- 
tions. Throughout this chapter, we will denote the space of cusp forms of 
weight k, group Ti{N) and character e by Sk{N, e). 

6.1 MODULAR SYMBOLS 

Modular symbols provide a way of doing symbolic calculations with mod- 
ular forms, as well as the homology of modular curves. In this section our 
intention is to give the reader an idea of what is going on rather than a 
complete and detailed account of the material. For more details and further 
reading on the subject of modular symbols, the reader could take a look 
at [Manl], [She] and [Mer]. A computational approach to the material can 
be found in [Stel] and [Ste2]. 

6.1.1 Definitions 

Let A be the free abelian group on the symbols {a, /?} with a, /3 G P^(Q). 
Consider the subgroup I C A generated by all elements of the forms: 



{a,P} + {p,j} + {^,a}, {a,P} + {P,a}, and {a,a}. 
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We define the group: 

M2 := (A/7) /torsion 

as the quotient of A/7 by its torsion subgroup. By a shght abuse of notation, 
we will denote the class of {a, /?} in this quotient also by {a, P}. We have 
an action GLJ(Q) on M2 by: 

j{a,p} := {70,7^}, 

where 7 acts on (Q) by fractional linear transformations. 

For A; > 2, we consider also the abelian group Z[x, y]k-2 C Z[x, y] of 
homogeneous polynomials of degree k — 2 and we let matrices in GLg" (Q) 
with integer coefficients act on it on the left by: 



and we equip with the component-wise action of integral matrices in 
GL+(Q) (that is j{P a) = j{P) 7(a)). 

6.1.2 Definition Let A; > 2 be an integer. Let T c SL2 (Z) be a subgroup 
of finite index and let 7 c be the subgroup generated by all elements 
of the form 7.T — x with 7 G F and x G M^. Then we define the space of 
modular symbols of weight k for F to be the quotient of /7 by its torsion 
subgroup and we denote this space by Mfc(r): 



In the special case T = ri(iV), which we will mostly be interested in, 
Mfe(r) is called the space of modular symbols of weight k and level N. 
The class of {a, (3} in Mjt(r) will be denoted by {a, (3}r or, if no confusion 
exists, by {a, /3}. 

The group ro(A^) acts naturally on Mjt(ri(A/^)) and induces an action 
of (Z/iVZ)^ on Mfe(ri(iV)). We denote this action by the diamond sym- 
bol {d). The operator {d) on Mfe(ri (iV)) is called a diamond operator. This 
leads to the notion of modular symbols with character. 




We define: 



Mk :=Z[a;,?/]fc_2®M2, 



Mfe(r) := (Mfe/7) /torsion. 
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6.1.3 Definition Let e: {Z/NZ)^ ^ C be a Dirichlet character. Denote 
by Z[e] C C the subring generated by all values of e. Let / be the Z[£]- 
submodule of Mfc(ri(Af)) (gi Z[e] generated by all elements of the form 
{d)x - £{d)x with d G (Z/ATZ)^ and x G Mfe(ri(A^)). Then we define 
the space M.k{N, e) of modular symbols of weight k, level N and character 
£ as the Z[£]-module: 

Mk{N,e) := (Mfc(ri(Ar)) ® Zfe]//) /torsion. 

We denote the elements of Mk{N, e) by {a, (3} or simply by {a, P}. If 
£ is trivial, then we have Mk{N, e) = Mfc(ro(iV)). 

Let B2 be the free abelian group on the symbols {a} with a G P^(Q), 
equipped with action of SL2(Z) by 'y{a} = {ja} and define as 
Z[x,y]k-2 <^ B2 with component-wise SL2(Z) -action. Elements of are 
called boundary modular symbols. For a subgroup F < SL2 (Z) of finite 
index, we define Bfe(F) as: 

Bfe(F) := (Bfe//) /torsion 

where / is the subgroup of Bj^ generated by all elements jx — x with 7 G F 
and X G B^. We define: 

Mk{N,e) := ((Bfe(Fi(iV)) Z[e]) //) /torsion, 

where / is the Z[e]-submodule of Bfc(Fi(A^)) (g) Z[e] generated by the ele- 
ments jx — e(7)x with 7 G Tq{N). 
We have boundary homomorphisms: 

5: Mfc(F) ^ Bfc(F) and 6: Mk{N,e) Mk{N,e) 

defined by: 

(5 (P ® {a, P})=P^{P}-P^ {a}. 

The spaces of cuspidal modular symbols, denoted by Sfc(r) and Sk{N,e) 
respectively are defined as the kernel of S. 

6.1.4 Properties 

One can interpret the symbol {a, P} as a smooth path in H U P^(Q) from 
the cusp a to the cusp P, lying in H except for the endpoints a and p. It can 
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be shown that this interpretation induces an isomorphism: 

M2(r) ^ i7i(Xr, cusps, Z). 

Here the homology is taken of the topological pair (Xi (N), cusps ) . We also 
get an isomorphism: 

S2(r)^i/i(Xr,Z). 
So we immediately see that there is a perfect pairing: 

(§2(r(iv)) ® c) X (52(r(iv)) e M^iN))) ^ c 

defined by: 

Ja \ Q 1 J 

More generally, there is a pairing 

(6.1.5) Mfc(ri(iv)) X (5fc(ri(iv)) e 5fc(ri(iv))) ^ c 

defined by: 

(P ® {a, /3}, / ®g)^ l-Ki / (/(z)P(z, \)dz - 9{z)P{z, l)dz) , 

J a 

which becomes perfect if we restrict and then tensor the left factor to 
Sfc(r(Ar)) (g) C. This pairing induces a pairing: 

(Mfc(iV,£)) X {Sk{N,e)eSk{N,e)) 

which becomes perfect when the left factor is restricted and then tensored to 
Sfe(A^, e) ^z[e] C. From now on we will denote all these pairings with the 
notation: 

(xj) ^ {x,f). 

6.1.6 The star involution 

On the spaces Mjt(ri(A'^)) and Mk{N, e) we have an involution l*: 

i\P{x, y) ® {a, P}) := -P{x, -y) ® {-a, -^}, 
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which is called the star involution. It preserves cuspidal subspaces. We de- 
fine §fc(ri(Ar))+ and Sfe(ri(iV))" subspaces of ^k{^i{N)) where l* acts 
as +1 and —1 respectively and we use similar definitions for E>k{N, s)^. It 
can be shown that the pairing (6. 1 .5) induces perfect pairings: 

(§fe(ri(iv))+®c) x5fe(ri(iv))^c 

and: 

(Sk(Ti{N))- ® C) X Sk(^i{N)) ^ C 

and similarly for the spaces with character. This allows us to work some- 
times in modular symbols spaces of half the dimension of the full cuspidal 
space. 

6.1.7 Hecke operators 

Let k>2 and A^>1 be given. Then for 7 G GL+(Q) n M2(Z) we define an 
operator on Mfc(ri(A^)) by letting 71, . . . , 7^ be double coset represen- 
tatives for ri(Ar) \ ri(Ar)7ri(iV) and putting 

r 

(6.1.8) r^(x):=^7ix forx G Mfc(ri(Af)). 

i=l 

It follows from [Sho, Theorem 4.3] that this operator is well-defined. For a 
prime number p we put Tp = for 7 = p) ^^'^ positive integers n 
we define T„ by means of the formal identity (2.2.1 1). The operators T„ are 
called Hecke operators. 

The Hecke operators preserve the subspace Sfc(ri(A^)) and induce an 
action on the spaces Mk{N, e) and S:k{N, e). Furthermore, from [Sho, The- 
orem 4.3] one can conclude that the diamond and Hecke operators are self- 
adjoint with respect to the pairings defined in the previous subsection: one 
has 

(6.1.9) {Tx,f) = {x,Tf) 

for any modular symbol x, cusp form / and diamond or Hecke operator 
T for which this relation is well-defined. Here, for anti-holomorphic cusp 
forms we define the Hecke action by Tf = Tf. Also, the Hecke operators 
commute with the star involution l*. 
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In conclusion, we have seen how we can write cusp forms spaces as 
the dual of modular symbols spaces. The computation of Hecke oper- 
ators on these modular symbols spaces would enable us to compute q- 
expansions of cusp forms: ^-coefficients of newforms can be computed 
once we can compute the eigenvalues of Hecke operators. But because 
of (6.1.9) this reduces to the computation of the eigenvalues of Hecke op- 
erators on modular symbols spaces. In computations one often works with 
the spaces Sfc(A^, e)^ ^zie] Q(^) because these have smaller dimension than 
Ski^ii^)) CS) Q. Since we also know how all cusp forms arise from new- 
forms of possibly lower level (see (2.2.17)), this allows us to compute the 
^-expansions of a basis for the spaces -S'fe(ri (N)) and Sk{N, e). For precise 
details on how these computations work, please read [Ste2, Chapter 9]. 



6.1.10 Manin symbols 

If we want to do symboUc calculations with modular symbols, then the 
above definitions are not quite applicable since the groups of which we take 
quotients are not finitely generated. The Manin symbols enable us to give 
finite presentations for the spaces of modular symbols. 

First we need some definitions and lemmas. For a positive integer A'^ we 
define a set: 

En := {{c,d) G {Z/NZf : gcd(iV,c,d) = l} . 
Define the following equivalence relation on ^^v: 

(c, d) ~ (c', d') ^ there is an a G {Z/NZy with (c, d) = {ac', ad') 
and the denote the quotient by Pn'- 
(6.1.11) Pj^:=En/--. 
The following lemma is easily verified: 

6.1.12 Lemma Let N he a positive integer. Then the maps 

Ti{N) \ SL2(Z) ^ En : {^^^^ ^ {c,d) and 
To{N) \ SL2(Z) -^P^:h^^\^-{^ 
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are well-deBned and bijective. 

This lemma enables us to write down an exphcit set of coset representatives 
for the orbit spaces Ti{N) \ SL2(Z) and ro(iV) \ SL2(Z). The following 
lemma provides us a first step in reducing the set of generators for the spaces 
of modular symbols: 

6.1.13 Lemma Each space M2(ri(iV)) or M2(iV,e) is generated by the 
symbols {a/c, b/d} with a,b,c,d e Z and ad — bc = 1, where in this nota- 
tion a fraction with denominator equal to zero denotes the cusp at infinity. 

Calculating the continued fraction expansion at each cusp in Q gives us 
immediately an algorithm to write a given element of M2 in terms of the 
generators in the lemma. Furthermore, note that: 



so that we can write each element of M2 as a sum of 7(00,0} with 
7 G SL2(Z). 

Let's consider the space M2(ri(iV)). As we saw, it is generated by the 
elements 7(00,0} where 7 runs through SL2(Z). Now, two matrices 7 
define the same element this way if they are in the same coset of the quotient 
ri(-^) \ SL2(Z). According to Lemma 6.1.12 such a coset can be uniquely 
identified with a pair (c, d) G (Z/NZ)"^. The corresponding element in 
M2(ri(A^)) is also denoted by (c, d). This element (c, d) is called a Manin 
symbol. Clearly, there are only a finite number of Manin symbols so we now 
know a finite set of generators for M2(ri(A^)). 

For arbitrary k we define the Manin symbols in M^.{Ti{N)) as the sym- 
bols of the form P (g) (c, d) where P is a monomial mZ[x, y]k-2 and (c, d) 
a Manin symbol in M2(ri(A?^)). In this case as well there are finitely many 
Manin symbols and they generate the whole space. 

In the modular symbols spaces with a given character e we have, for all 
7 G ro(A^), that 7(0;) = e(a). Now for each element of P/v we choose ac- 
cording to Lemma 6.1.12 a corresponding element 7 G SL2(Z) and hence 
an element in M2{N, s), which we call again a Manin symbol. Note that 
this Manin symbol depends on the choice of 7, but because of the relation 
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7(x) = e{x) these chosen Manin symbols always form a finite set of gener- 
ators for M2(A^, e) as a Z[e]-module. Liltewise, Mk{N,e) is generated by 
elements P (g) (c, d) with P a monomial mZ[x, y]k-2 and (c, d) a Manin 
symbol in M2(iV, e). 

If we want to do symbohc calculations, then besides generators we also 
need to know the relations between the Manin symbols. For Mfe(ri(iV)) 
one can do the following. 

6.1.14 Proposition Let N bea positive integer and let A be the free abelian 
group on the Manin symbols of the space M^.(ri(7V)). Let I C A be the 
subgroup generated by the following elements: 

P{x, y) ® (c, d) + P{-y, x) ® {-d, -c), 

P{x, y) ® (c, d) + P{-y, x - y) (g) {-d, -c - d.) 

+ P{-x + y, -x) (g) (-C - d, -c), 
P{x, y) ® (c, d) - P{-x, -y) ® (c, d), 

where P{x, y) (g) (c, d) runs through all Manin symbols. Then Mfe(ri(iV)) 
is naturally isomorphic to the quotient of A/ 1 by its torsion subgroup. 

For the modular symbols spaces ( A^, e) we have a similar proposition. 

6.1.15 Proposition Let N and e be given. Let Abe the free Z[£]-module 

on the Manin symbols ofM.k{N, e). Let I C Abe the submodule generated 
by the elements given in Proposition 6.1.14 plus for each n G (Z/A^Z)^ the 
elements: 

P{x,y) (g) {nc,nd) — e{n)P{x,y) (g (c, d). 

Then Mk{N, e) is naturally isomorphic to the quotient of A/ 1 by its torsion 
submodule. 

These presentations enable us to perform symbolic calculations very effi- 
ciently. 

A remark on the computation of Hecke operators is in order here. The 
formula (6.1.8) does not express the Hecke action on Manin symbols in 
terms of Manin symbols. However, one can use other formulas to compute 
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Hecke operators. The fohowing theorem, due to Merel, allows us to express 
Hecke operators more directly in terms of Manin symbols: 

6.1.16 Theorem (see [Mer, Theorem 2]) On the spaces Mk{Ti{N)) and 
Mk{N, e) the Hecke operator Tn satisfies the following relation: 

El 
P{ax + by,cx + dy) ® {au + cv,bu + dv) , 

a>b>0 
d>c>0 
ad—bc=n 

where the prime in the notation for the sum means that terms with 
god (AT, au + cv,bu + dv) ^ 1 have to be omitted. 

One would also hke to express Sfc(ri(iV)) and §fc(A'^, e) in terms of the 
Manin symbols. The following proposition will help us. 

6.1.17 Proposition (see [Mer, Proposition 4]) Let integers N > 1 and 
k > 2 be given. Define an equivalence relation on the vector space 

Q[ri(iV)\Q2]by; 

[\x] ~ sign(A)'' [x] for X e Q"" and x e (f. 

Then the map: 

/i:Bfc(ri(iV))^Q[ri(Ar)\Q2]/~ 

given by: 

is well-defined and injective. 

The vector space Q[ri (A^) \Q^] / is finite dimensional. The above propo- 
sition shows that Sfe(ri(iV)) is the kernel of /x(5, which is a map that can be 
computed in terms of Manin symbols. The computation of E>k{N, e) can be 
done in a similar way, see [Ste2, Section 8.4]. 

6.2 INTERMEZZO: ATKEV-LEHNER OPERATORS 

In the rest of this chapter, we will be using the Atkin-Lehner operators on 
Sk{Ti{N)) from time to time. This section provides a brief treatment of the 
properties that we need. The main reference for this material is [At-Li]. 



C) 



(a, b coprime integers) 
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Let Q be a. positive divisor of N such that gcd{Q,N/Q) = 1. Let 
wq G GL^ (Q) be any matrix of the form: 

' Qa b 
^Nc Qd, 

with a,b,c,d G Z and dei{wQ) = Q. The assumption gcd{Q,N/Q) = 1 
ensures that such a wq exists. A straightforward verification shows 
f\kWQ G Sk{Ti{N)). Now, given Q, this f\kWQ still depends on the choice 
of a, b, c, d. However, we can use a normahsation in our choice of a, 6, c, d 
which will ensure that f\kWQ only depends on Q. Be aware of the fact that 
different authors use different normahsations here. The one we will be using 
is: 

(6.2.2) a = 1 mod N/Q, b = 1 mod Q, 

which is the normalisation used in [At-Li]. We define: 

WQ{f): = Q^-''/^f\kWQ 
(6-2.3) Qk/2 f Qaz + b 



\kf 



{Ncz + Qdf-' \Ncz + Qd, 

which is now independent of the choice of wq and call Wq mAtkin-Lehner 
operator. In particular we have: 

^^(/) = ]^/(^ 

An unfortunate thing about these Atkin-Lehner operators is that they do 
not preserve the spaces Sk{N,e). But we can say something about it. Let 
e: (Z/NZ)^ be a character and suppose that / is in Sk{N,e). 

By the Chinese Remainder Theorem, one can write e in a unique way as 
£ = £qSj^/q such that eq is a character on (Z/QZ)^ and £n/q is a charac- 
ter on (Z/(iV/Q)Z) . It is a fact that: 

WQ{f)€SkiN,eQe^/Q). 

Also, there is a relation between the g-expansions of / and VFq(/): 

6.2.4 Theorem Let f be a newfonn in Sk{N, e). Take Q dividing N with 
gcd{Q,N/Q) = 1. Then: 

WqH) = \Q{f)g 



bookarxiv March 23, 2010 



COMPUTATIONS WITH MODULAR FORMS AND GALOIS REPRESENTATIONS 1 51 

with Aq(/) an algebraic number in C of absolute value 1 and g a new- 
form in Sk {N, eqej^iq). Suppose now that n is a positive integer and write 
n = nin2 where ni consists only of prime factors dividing Q and n2 con- 
sists only of prime factors not dividing Q. Then we have: 



anig) = £Ar/Q(rai)eQ(n2)a„i(/)a„2(/)- 

The number Aq(/) in the above theorem is called a pseudo-eigenvalue for 
the Atkin-Lehner operator. In some cases there exists a closed expression 
for it. In the notation of the following theorem, g{x) denotes the Gauss sum 
of a Dirichlet character x of conductor N{x)'- 

(6.2.5) g{x):= ^ ^^^^^^pfl?^)- 

6.2.6 Theorem Let f e Sk {N, e) be a newform and suppose q is a prime 
that divides N exactly once. Then we have: 



\ (f\ = } 3{£q)q ^'"^o-qU ) if Sq is non-trivial, 

6.2.7 Theorem (see [Asa, Theorem 2]) Let f ^ Sk {N, e) be a newform 
with N square-free. For Q | we have: 

XQ{f) = e{Qd-^a)l[e{Q/q)Xq{f). 
^ g\Q 

Here, a and d are defined by (6.2.1). Moreover, this identity holds without 
any normalisation assumptions on the entries of wq, as long as we define 
Xq{f) by the formula given in Theorem 6.2.6. 



6.3 BASIC NUMERICAL EVALUATIONS 



In this section we will describe how to perform basic numerical evaluations, 
such as the evaluation of a cusp form at a point in H and the evaluation of 
an integral of a cusp form between to points in H U (Q). Again, the focus 
will be on performing actual computations. 
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6.3.1 Period integrals: the direct method 

In this subsection we wiU stick to the case k = 2, referring to [Ste2, Chap- 
ter 10] for a more general approach (see also [Cre, Section 2. 10] for a treat- 
ment of To{N)). So fix a positive integer N and an / e S'2(ri(A^)). Our 
goal is to efficiently evaluate the integral pairing {x, f) for x G §2(1"! (^))- 
Let us indicate why it suffices to look at newforms /. Because of (2.2. 17), 
it suffices to look at / = 0^(7') with /' G Sk{Ti{M)) a newform for some 
M \ Nandd\ N/M. By [Sho, Theorem 4.3] we have: 

(x,/) = (x,a,(/0)=di-'={^(jjj)x,/'^ 

so that computing period integrals for / reduces to computing period inte- 
grals of the newform /'. 

Let us now make the important remark that for each z G H we can nu- 
merically compute fdq/qhy formally integrating the g-expansion of /: 



(6.3.2) 




where q = exjp{27:iz). 



The radius of convergence of this series is 1 and the coefficients are small 
(that is, estimated by d{n^^~^'^/'^)). So if $52; > then we have \q\ < 1 
and the series converges rapidly. To be more concrete, for SJz > M we have 
< exp(— 27rMn) so if we want to compute fdq/qXo a precision of 
p decimals, we need to compute about ^^^^ ~ ^-^^m of the series. 

To compute a period integral we remark that for any 7 G Ti{N) and any 
z G IHIUP"'"(Q) any continuous, piecewise smooth path 5 in ]HIUP"^(Q) from 
z to 72, the homology class of 5 pushed forward to Xi (N) (C) depends only 
on 7 [Manl, Proposition 1.4]. Let us denote this homology class by: 

{00,700} G S2(ri(Ar)) ^ Hi{Xi{N){C),Z) 

and remark that all elements of Hi{Xi{N){C),Z) can be written in this 
way. As we also have S'2(ri(iV)) = i7°(Xi(Ar)c, O^), this means we can 
calculate J^^ by choosing a smart path in H U P^(Q): 

J 00 Q Jz Q Joo Q Joo Q 
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If we write 7 = 




then a good choice for z is: 



d i 
c \c\ 

In this case we have Qz = Qjz = l/|c| so in view of (6.3.2), to compute 
the integral to a precision of p decimals we need about p*^^"^^^ ^ 0.37pc 
terms of the series. 

Another thing we can use is the Hecke compatibihty from (6.1.9). Put: 

Wf := (§2(ri(7V))/7/S2(ri(Ar))) ® Q, 

where If is the Hecke ideal belonging to /, i.e. the kernel of the map T — C 
that sends T„ to a„ for all n (here, as usual, T denotes the Hecke algebra 
attached to S2{Ti{N))). The space Wj has the structure of a vector space 
over (T/Jj) (g) Q = Kf of dimension 2. This means that computing any 
period integral of /, we only need to precompute 2 period integrals. So 
one tries to find a iir/-basis of Wf consisting of elements {00, 700} where 
7 G ri(iV) has a very small c-entry. In practice it turns out that we do not 
need to search very far. 



6.3.3 Period integrals: the twisted method 

In this subsection we have the same set-up as in the previous subsection. 
There is another way of computing period integrals for / G 5'2(ri(A^)) 
which sometimes beats the method described in the previous subsection. 
The method described in this subsection is similar to [Cre, Section 2.11] 
and makes use of winding elements and twists. 

The winding element of M2(ri(A'^)) is simply defined as the element 
{00, 0} (some authors define it as {0, 00}, this is just a matter of sign con- 
vention). Integration over this element is easy to perform because we can 
break up the path in a very neat way: 



Joo Q Joo Q Ji/VN Q 

A+ / w^if)^= / if-w^if))'- 

Q Ji/VN Q Joo 



J 
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Now, choose an odd prime C, not dividing N and a primitive Dirichlet char- 
acter Z -> C of conductor ^. If / G Sk{Ti{N)) is anewform then f ®x 
is anewform in Sk(J^i{Nl'^)), where: 



ii>i 



The following formula to express x as a linear combination of additive char- 
acters is well-known: 



where g{x) is the Gauss sum of x (see (6.2.5)). It follows now immediately 
that: 



f ^ six) 
f ®X = -Y~ 

For / G S'2(ri(Ar)) we now get the following useful formula for free: 

(6.3.4) ({oo, 0}, / ® = ^ x{-y) 7 } ' 

The element x{-^) {oo, f } of Mfc(ri(iV)) Z[x] or of some other 

modular symbols space where it is well-defined is called a twisted winding 
element or, more precisely the X'twisted winding element. Because of for- 
mula (6.3.4), we can calculate the pairings of newforms in S'2(ri(A^)) with 
twisted winding elements quite efficiently as well. 

We can describe the action of the Atkin-Lehner operator Wj.^p aa f ®x'- 

Wm<f®x) = ^£(%(-iV)Aiv(/)/0x, 



where / = Ylin>i ^ri{f)(l^ (see for example [At-Li, Section 3]). So in par- 
ticular we have the following integral formula for a newform / G S2{N, e): 

/ f®x-= {f®X-Wi,p{f®x))- = 

f6 3 5) ^ ^ 

f®X- ^x(-iV)£(^)A^(/)/ ®xj^- 



Joo V 
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So to calculate: 



we need to evaluate the series (6.3.2) at z in H with = l/{£-\/N) 
which means that for a precision of p decimals we need to sum about 
ptVNk>gW _ o.37p^\/]V terms of the series. In the spirit of the previous 

subsection, we try several £ and x> as well as the untwisted winding element 
{oo, 0}, until we can make a K^-basis for Wf. It follows from [Shi2, The- 
orems 1 and 3] that we can always find such a basis. Also here, it turns out 
that in practice we do not need to search very far. The method that requires 
the least amount of of g-expansion terms is preferred. 

6.3.6 Computation of ^-expansions at various cusps 

The upper half plane M is covered by neighbourhoods of the cusps. If we 
want to evaluate a cusp form / G Sk{Ti{N)) or an integral of a cusp form 
at a point in such a neighbourhood then it is useful to be able to calculate 
the ^-expansion of / at the corresponding cusp. We shall mean by this the 
following: A cusp a/c can be written as 700 with 7 = (^^ ^ SL2(Z). 
Then a g-expansion of / at a/c is simply the g-expansion of f\k^. This 
notation is abusive, since it depends on the choice of 7. The (/-expansion 
will be an element of the power series ring C[[gi/"']] where w is the width 
of the cusp a/c and q^^'^ = exp{2TTiz/w). 

If the level N is square-free this can be done symboUcally. However, for 
general A'^ it is not known how to do this, but we shall give some attempts 
that do at least give numerical computations of q-expansions. We use that 
we can compute the g-expansions of newforms in Sk(ri{N)) at 00 using 
modular symbols methods. 

The case of square-free N 

The method we present here is due to Asai [Asa]. Let N be square-free and 
let / G S'fc (Fi ( A^) ) be a newform of character e. The main reason for being 
able to compute ^'-expansions at all cusps in this case is because the group 
generated by Vq{N) and all wq (see (6.2.1)) acts transitively on the cusps. 
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something that is not true when N is not square-free. 
So let 7 = ^) G SL2(Z) be given. Put: 

N 



^ — TTTT — \i Q 



lcA{N, c) ' ^ gcd(iV, c) ■ 

Let r G Z be such that d = cr mod Q and define b' ,d' G Z by: 

Qd' = d — cr and b' = b — ar. 

Then we have: 

\cd) ~ \Nd Qd'J \ 1 J ' 
Theorems 6.2.4 and 6.2.7 tell us how ^ q^,^ acts on g-expansions. The 
action of (^*^o ^ ^"^i ) '^^ g-expansions is simply: 

^ a^g" ^ a„CS-g"/'3 with Cq = exp(^). 

n>l n>l 

This shows how the (/-expansion of /|fc7 can be derived from the q- 
expansion of /. 

Let us now explain how to do it for oldforms as well. By induc- 
tion and (2.2.17) we may suppose / = ap{f') with p \ N prime, 
/' G Sk{Ti{N/p)) and that we know how to compute the g-expansions 
of /' at all the cusps. Let 7 = d) given. Then we have: 



i-k.n IP0\ fpapb 



We will now distinguish on two cases: p | c and p^ c.Ifp \ c then we have 
a decomposition: 

^pa pb\ / a pb\ f p 0^ 
c d J ~ \c/p dy VO 1, 
and we know how both matrices on the right hand side act on g-expansions. 
If p f c, choose b', d' with pad' — b'c = 1. Then we have: 

'pa pb\ / pa b' 
^ c d ) ^ \ c d' 

with P G GL^ (Q) upper triangular, so also in this case we know how both 
matrices on the right hand side act on g-expansions. 
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The general case 

In a discussion with Peter Bruin, the author figured out an attempt to drop 
the assumption that N be square-free and compute g-expansions of cusp 
forms numerically in this case. The idea is to generalise the Wq operators 
from Section 6.2. 

So let N be given. Let Q be a divisor of N and put R = gcd((5, N/Q). 
Let WQ be any matrix of the form: 

(RQa b \ . , , , ^ 
'"'^=[RNcQd) witha,6,c,dGZ 

such that det wq = QR^ (the conditions guarantee us that such matrices do 
exist). One can then verify: 

FiiNR^) < WQ^riiN)wQ, 

so that slashing with wq defines a hnear map: 

5fe(ri(iv)) e 5fc(ri(7V)) H Skir^iNR^))®Sk{ri{NR^)) 

which is injective since the slash operator defines a group action on the space 
of all functions H -)• C. 

On the other hand, wq defines an operation on which can be shown 
to induce a linear map: 

wq: §kiri{NR^))(^q^§k{Ti{N))(g)Q 

that satisfies the following compatibility with respect to the integration pair- 
ing between modular symbols and cusp forms (see [Sho, Theorem 4.3]): 

(6.3.7) {wQX,f) = {x,f\kWQ). 

Let {xi, . . . ,Xr) and {yi,...,ys) be bases of Sk{Ti{N)) (g) Q and of 
Sjk(ri(iVi?^)) Q respectively. Then one can write down a matrix A in 
terms of these basis that describes the map wq since we can express any 
symbol P {a, (3} in terms of Manin symbols. The matrix then defines 
the action of wq in terms of the bases of the cusp forms spaces that are dual 
to {xi,...Xr) and (yi,...,^^). 

Now, let (/i, . . . ,/r) be a basis of Sk{Ti{N)) Sk{Ti{N)) and let 
(51, ... , gs) be a basis of Sk{ri{NR'^)) Sk{Ti{NR^)) (for instance we 
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could take bases consisting of eigenforms for the Hecke operators away 
from A^). Define matrices: 

B ■■= {{xi, fj))^j and C := {{yi, gj)).. . 

These can be computed numerically as the entries are period integrals. 
Then the matrix C~^A^B describes the map -{kWQ in terms of the bases 
(/i, . . . , /r) and {gi,. . . ,gs). Hence if we can invert C efficiently, then we 
can numerically compute the g-expansion of flkWQ with / G Sk{Ti{N)). 
Let now a matrix 7 = ^ " g SL2(Z) be given. Put: 

c' := gcd{N, c) and Q := N/c'. 

Because of gcd{c/d ,Q) = 1 we can find a G (Z/QZ)^ with ac/d = 1 
mod Q. If we hft CK to (Z/NZ)^ then we have ac = d mod TV. Let now 
d' G Z be a lift of ad G (Z/A^Z)^. Because ac and ad together generate 
Z/NZ we have gcd(c', d') = 1 and so we can find a', 6' G Z that satisfy 
a'd' — h'd = 1. According to Lemma 6.1.12, we have: 

fa' b'\ , , 

7 = 7o( , with7o G ro(iV). 

Put R = gcd(c',Q). Then we have gcd{N R, Ra') = QRgcd{c! ,Qa') 
and hence gcd{NR, Q'^Ra') = QR^, so there exist b", d" G Z with: 

(QRa' h" 
'■= [ NR Qd" 

having determinant QR^. One can now verify that we have = WQf5 

with (3 G GL^ (Q) upper triangular. So in the decomposition: 

7 = IowqP 

we can compute the slash action of all three matrices on the right hand side 
in terms of g-expansions, hence also of 7. 

In conclusion we see that in this method we have to increase the level 
and go to Sk{Ti{NR'^)) for the square divisors R^ of N to compute q- 
expansions of cusp forms in Sk{Ti{N)) at arbitrary cusps. 
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6.3.8 Numerical evaluation of cusp forms 

For / G SkiTi{N)) and a point P G H we wish to compute f{P) to a 
high numerical precision. Before we do this let us say some words on how 
P should be represented. The transformation property of modular forms 
implies that representing P as x + iy with x,y G M is not a good idea, as 
this would be numerically very unstable when P is close to the real Une. 
Instead, we represent P as: 

(6.3.9) P = 72; with 7 G SL2(Z), z = x + iy, x < 00 and y > 0. 

For instance, one could demand that z be in the standard fundamental do- 
main: 

J" := {z G M : \^z\ < 1/2 and \z\ > 1} 

for SL2 (Z) acting on H, although this is not strictly necessary. 

So let P = 7z be given, with j = (^^ '^^^ e SL2(Z) and 3z > M, say. 
Let w = w{'-f) be the width of the cusp 700 with respect to ri(A'^). To 
compute /(P) we make use of a (/-expansion of / at 700: 



/(P) = (cz + d)\f\k^)iz) = {cz + df ^'nq"" 



jw 

n>l 



The radius of convergence is 1 and the coefficients are small (estimated by 
Q|^^(fc-i)/2j-) compute /(P) to a precision of p decimals we need 

about « 0.37^ terms of the g-expansion of f\k-f. 

Of course, we have some freedom in choosing 7 and z to write down P. 
We want to find 7 such that P = jz with Qz/w('y) as large as possible. In 
general, one can always write P = jz with z e T so one obtains: 

(6.3.10) max —— > ——. 

7eSL2(z) w(-f) 2N 

We see that in order to calculate /(P) to a precision of p decimals it suffices 
to use about '^'^^^^^ ^ QA2pN terms of the g-expansions at each cusp. 
Although for many points P there is a better way of writing it as jz in 
this respect than taking z E T, it seems hard to improve the bound in 
general. 
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We wish to adjust the representation sometimes from P = ^zto P = ^'z' 
where 7' G SL2 (Z) is another matrix, for instance because during our cal- 
culations has become too large or Qz has become too small (but still 
within reasonable bounds). We can make ^z smaller by putting z' := z — n 



is large. This simply means that we have to find a small vector cz + din the 
lattice Zz+Z, something which can be done easily if <C 00 and '^z ^ 0. 
If c and d are not coprime we can divide both by their greatest common 
divisor to obtain a smaller vector. The matrix 7" can now be completed and 
we put z' := ^' z and 7' := {pi')"^ . 

6.3.11 Numerical evaluation of integrals of cusp forms 

In this subsection we will describe for / G S'2(ri(A?^)) and P G H how to 
evaluate the integral fdq/q. As in the previous subsection, we assume 
P to be given by means of (6.3.9). The path of integration will be broken 
into two parts: first we go from 00 to a cusp a near P and then we go from 
a to P. 

Integrals over paths between cusps 
The pairing (6.1.5) gives a map: 



which is injective when restricted to S2(ri(-^))- The image of is alattice 
of full rank, hence the induced map: 





cz + d|2 



6: M2(ri(7V)) ^Homc (52(ri(iV)), C) 



S2(ri(iV)) (8) M ^ Home (52(ri(iV)), C) 



is an isomorphism. In particular we obtain a map: 



$ : M2(ri(iV)) ^ S2(ri(iV)) ® R, 
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which is an interesting map to compute if we want to calculate integrals 
of cusp forms along paths between cusps. The map $ is called a period 
mapping. 

The Manin-Drinfel'd theorem (see [Manl, Corollary 3.6] and [Dri, The- 
orem 1]) tells us that im($) c S2(ri (iV)) (g) Q. This is equivalent to saying 
that each degree divisor of Xi (N) which is supported on cusps defines a 
torsion point of Ji{N). The proof given in [Dri] already indicates how to 
compute <I> with symbolic methods: let jo be a prime that is 1 mod N. Then 
the operator p + 1 - Tp on M2(ri(iV)) has its image in S2iTi{N)). The 
same operator is invertible on S2(ri(A^)) Q. So we simply have: 

^ = {p+l-Tp)-\p + l-Tp), 

where the rightmost p+l—Tp denotes the map from M2(ri(Ar)) to 
S2(ri(iV)) and the leftmost p+l—Tp denotes the invertible operator on 
S2(ri(iV)) (g) Q. For other methods to compute see [Ste2, Section 10.6]. 
So we can express the integral of fdq / q between any two cusps a and (3 in 
terms of period integrals, which we have aheady seen how to compute: 



J a Q 



Integrals over general paths 

We can imitate the previous subsection pretty much. Write P G EI as 
P = jz with 7 G SL2(Z) such that 'isz/w{joo) is as large as possible. 
Then we have 

'■^ dq dq P-' dq 



f6 3 12) ^ ^ -^700 H 

Joo Q Joo <1 

The integral is over a path between two cusps so we can compute 

it by the above discussion and the integral J^ifUl)^ can be computed 
using the g-expansion of /I27: 



f 



{f\27)^=wY,^q-/-, 
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exp{2TTiz/w) and /I27 = ^anq"/"". Because 
at P^^iEsio PS 0A2pN terms of the series should 



Note also that we can use formula (6.3.12) to compute the pseudo- 
eigenvalue Aq(/) by plugging in 7 = wq and a z for which both and 
QwQZ are high and for which Wq{f)dq/q is not too close to zero. 



6.4 APPLYING NUMERICAL CALCULATIONS TO GALOIS REPRE- 
SENTATIONS 

Let / be a newform (of some level and weight) and let A | £ be a prime 
of its coefficient field. From Section 2.5 we know that a residual Galois 
representation p = pjr ^is attached to the pair (/, A). The fixed field Kx of 
ker(p) in Q is a number field. The results from Chapter 14 point out that we 
know that computing p essentially boils down to computing a polynomial 
that has Kx as sphtting field. In this section we describe how numerical 
calculations can be used to compute such a polynomial. We will follow 
ideas from Chapter 3. 

Theorem 2.5.7 shows that we can reduce this problem to the case of a 
form of weight 2 in most interesting cases. Hence we will assume that / is 
a newform in 6'2(ri(A^)). Assume that the representation 'pf x is absolutely 
irreducible and let T be the Hecke algebra acting on Ji{N). There is a 
subspace Vx of Ji{N){Q)[i] on which botii T and Gal(Q/Q) act, such that 
the action of Gal(Q/Q) defines pf^x- 



6.4.1 Approximation of torsion points 



The Jacobian Ji(iV)c can be described as follows. Pick a basis fi,. . . , fg 
of 52(ri(iV)). Put: 



A:= : [7] GiIi(Xi(iV)(C),Z)| CC^. 
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This is a lattice in of full rank. By the Abel-Jacobi theorem we have an 
isomorphism: 

Ji(iV)(C)^C7A, 

Let now a divisor X^f=i[i?i] on Xi{N) be given. Identifying Ji{N){C) 
with C^/ A in this way, we get a birational morphism 

(f): Sym5Xi(A^)(C) ^ C»/A, 

The homology group Hi{Xi{N){C),Z) is canonically isomorphic to the 
modular symbols space S2(ri(A^))- The period lattice A can thus be com- 
puted numerically using the methods from Subsections 6.3.1 and 6.3.3. 
Since we can compute the action of T on S2{Ti{N)) = A, we can write 
down the points in|A/AcC^/A that correspond to the points of V\. The 
aim is now to compute the divisors on Xi{N)c that map to these points 
along 0. In our computations, we assume without proof that Vx lies beneath 
the good locus of (j), i.e. the map Xi(iV)^ — )• C^/A induced by (/) is etale 
above V^. 

We start calculating with a small precision. Let a non-zero P in 
V\{C) C C^/A be given. First we try out a lot of random points 
Q={Qi,. . . ,Qg) in Xi{N)(Cy. Here, each Qi will be written as 
Qi = liWi, with 7j in a set of representatives for Ti{N) \ SL2(Z) and 
Wi G J^. We can compute (f){Q) using methods from Subsection 6.3.11. We 
work with the point Q for which (t){Q) is closest to P. If we in fact already 
know some points Q with (f){Q) approximately equal to a point in V\{C), 
then we could also take one of those points as a starting point Q to work 
with. 

The next thing to do is adjust Q so that (t){Q) comes closer to P. 
We'll make use of the Newton-Raphson approximation method. Let 
(j)'-W ^ C»/A be the function defined by: 

(t){zi, ...Zg) = (?!)(7i2;i, . . . TpZg). 
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We observe that for a small vector h = {hi, . . . hg) G we have: 

<l>'{Wl +hl,...,Wg + hg)= ^{Q) +hD + 0{\\hf) 

with: 



D = 



/ a<t,'g \ 



(wl,...,Wg) 

From the definition of cj) we can immediately deduce: 

...,Wg) = 2'Ki- {fi\2lj){Wj), 

where we apologise for the ambiguous i. We can thus compute the ma- 
trix D using the methods of Subsection 6.3.8. Now choose a small vector 
V = {vi, . . . ,Vg) G such that 4>{Q) + v is closer to P than (j){Q) is. 
For example, v can be chosen among all vectors of a bounded length so that 
(t){Q) + vis closest to P. If we write: 

h = vD-'^, 

then we expect 4>'{'W\-\-h\,. . . ,Wg+hg) to be approximately equal to 
4){Q)+v. If this is not the case, then we try the same thing with a smaller v. 
It could be that this still fails, for instance because we are too close to the 
bad locus of the map 4>. In that case, we start with a new random point Q. 

We repeat the above adjustments until we are (almost) as close as we 
can get considering our calculation precision. It might happen that the wi 
become too wild, i.e. \^Wi\ becomes too large or "^wi becomes too small. 
If this is the case we adjust the way we write Qi as ^iWi using the method 
described in Subsection 6.3.8. We can always replace the 7j then by a small 
matrix in the same coset of ri(A^) \ SL2(Z). 

Once we have for each P ^ V\ ~ {0} a point Q such that (^{Q) is ap- 
proximately equal to P, we can start increasing the precision. We double 
our calculation precision and repeat the above adjustments {ct){Q)+v will in 
this case be equal to P). We repeat this a few times until we have very good 
approximations. 
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6.4.2 Computation of polynomials 

Now, we will choose a function in /i G Q{Xi{N)) and evaluate it at the 
components of the points in (p^^iVx). With the discussion of Chapter 3 in 
mind, we want h to take values of small height. Since h multiplies heights 
of points roughly by dcg(/i), we want to find a function of small degree. 
Take any k and a basis hi,. .. ,hn of Sk{Ti{N)) such that the g-expansions 
of the hi MemZ[[q]] and such that the exponents of the first non-zero terms 
of these g-expansions form a strictly increasing sequence. We propose to 
use h = WN{hn-i) /WN{hn) as a function to use (assuming n > 2). Re- 
member from Section 2.2 that Sk{Ti{N)) is the space of global sections of 
the line bundle C = cusps) on Xi{N), base changed to C. Be aware 

of the fact that the cusp oo of Xi {N) is not defined over Q, but the cusp 
is. Since we demand the g-expansions to have rational coefficients, the 
sections Wjv(/ii), . . . , WOv(^n)> with Wn an Atkin-Lehner operator, are 
defined over Q and they have increasing order at 0. One can now verify that 
for h = Wjv(/in-i)/Wjv(^n) we have: 

deg(/i) < degiC) - Vooihn-i) < deg(£) - dimH\C) + 2<g + l. 

For k = 2 and g > 2 v/e have C = Q^{Xi{N)) and we get ^ as an upper 
bound for deg(/i). Using methods from Subsection 6.3.8, we can evaluate h 
numerically. The author is not aware of a sophisticated method for finding a 
function h € Q{Xi{N)) of minimal degree in general; this minimal degree 
is called the gonality of the curve Xi (N). Published results on these matters 
seem to either be limited to Xo{N) or to concern only lower bounds for 
the gonality of modular curves, see for example [Abr], [Bak, Chapter 3] 
or [Poo]. 

Now put, for P G Vx{C) - {0}: 



g 



ap = ^h{Qi), v/heTe<p{Qi,...,Qg) = P. 



i=l 



We work out the product in: 



n 



n 




where n = deg Px . 



PeVx{C)-{0} 



k=0 
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The coefficients ak are rational numbers that we have computed numeri- 
cally. Since the height of Px is expected to be not too large, the denom- 
inators of the ak should have a relative small common denominator. The 
LLL algorithm can be used to compute integers po,... ,Pn-i, Q such that 
\Pk — o,kQ\ is small for all k, see [Le-Le-Lo, Proposition 1.39]. If the 
sequence (a^) is arbitrary, then we'll be able to find pk and q such that 
\Pk ~ Ofe^l is roughly of order g^^/" for each k, but not much better than 
that. So if it happens that we find p^ and q with \pk — a^q] much smaller 
than for all k, then we guess that ak is equal to Pk/q- If we can- 

not find such pk and q then we will double the precision and repeat all the 
calculations described above. 

Heuristically, the calculation precision that is needed to find the true value 
of ak is about (1 -I- 1/n) ■ height (Px)/ log (10) decimals. Another way of 
finding rational approximations of the is by approximating them using 
continued fractions. For this method, the precision needed to find the true 
value of ak would be about 2 • height (Pa) / log (10) decimals. 

Since the degree of Px will be quite large, we won't be able to do many 
further calculations with it. In particular it may be hard to verify whether 
all the guesses we made were indeed correct. Instead, we will look at the 
following variant. If m is the Hecke ideal of / mod A, then Vx is a vector 
space over T/m. The representation ^ induces an action px of Gal(Q/Q) 
on the set F{Vx) of lines in Vx- We can attach a polynomial Px to this 
projectivised representation px, analogously to the way this was done for p. 
This polynomial will have a smaller degree than Px. We put: 

m 

Px{x)= n ~ H ap)=^bkx^, where m = deg Pa- 
LeP(v«) PeL-{o} fe=o 

As above, if the calculation precision is sufficient we can use lattice reduc- 
tion algorithms to compute the exact values of the 6^. 

6.4.3 Reduction of polynomials 

Although the polynomial Pa will not have a very huge height, its height is 
still too large to do any useful computations with it. The first step in making 
a polynomial of smaller height defining the same number field is computing 



bookarxiv March 23, 2010 



COMPUTATIONS WITH MODULAR FORMS AND GALOIS REPRESENTATIONS 1 67 

the maximal order of that number field. Let q be the common denominator 
of the coefficients and put pk = bkq. Consider the polynomial: 



We make ourselves confident that we correctly computed Qix) (although 
we won't prove anything at this point yet). For instance, we verify that 
Q{x) is irreducible and that its discriminant has the prime factors of Ni in 
it. We can also compute for several primes p not dividing Disc{Q{x)) the 
decomposition type of Q{x) modulo p and verify that it could be equal to 
the cycle type of p(Probp). If not, we again double the precision and repeat 
the above calculations. 

Let now a be a root of Px{x) and write down the order: 



which is an order that is closer to the maximal order than Z[qa] (see [Len2, 
Subsection 2.10]). Being confident in the correctness of Q{x), we know 
where the number field K defined by it ramifies and thus we can compute its 
maximal order (see [Bu-Le, Section 6 and Theorems 1.1 and 1.4]). Having 
done this, we embed Ok as a lattice into C™ in the usual way and we use 
the LLL algorithm to compute a basis of small vectors in Ok- We can then 
search for an element of small length in Ok that generates K over Q. Its 
defining polynomial will have small coefficients. See also [Co-Di]. 

In the computation of the polynomials P\ and we made several 
guesses and assumptions that we cannot prove to be correct. In Chapter 7, 
we work out in special cases how we can use established parts of Serre's 
conjecture to prove afterwards for polynomials of the style P'^ that they in- 
deed belong to the modular Galois representations that we claim they belong 
to. See [Bosl] for another example of this. In the unlikely case that such 
tests may fail we can of course make adjustments like choosing another 
function h or another divisor to construct 0. 



Q{x) =q.Px{x)= qx"" +Pm-ix" 



,m— 1 



H \-po. 



0:=Z+^ IZ.^ 
k=i \ j=o 
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6.4.4 Further refinements 

The Jacobian Ji{N) has large dimension (for prime this dimension is 
(iV-5)(A^-7)/24). It could be that our newform / is an element of 5*2 (r) 
with ri(A^) < r < ro(A^). in that case we work with the curve Xr, which 
is given its Q-structure by defining it as a quotient of Xi{N). The Jacobian 
Jr of Xr is isogenous to an abeUan subvariety of Ji{N) that contains Vx, 
so this works perfectly well. 

In the case F = To{N) we can sometimes go a step further. The operator 
Wn on Xq{N), sending z to —1/Nz, is defined over Q. If / is invariant 
under Wn, one can work with the curve Xq{N) := Xq{N)/{Wn)- Its Ja- 
cobian Jf^{N) is isogenous to an abelian subvariety of Ji{N) that contains 
Vx, so also here it works. Some words on the computation of the homology 
of Xq{N) are in order. The action of Wjv on Xq{N) induces an action on 
Hi{Xo{N){C), Z) and on Hi{Xo{N){C), cusps, Z). Since paths between 
cusps on Xq{N){C) lift to paths between cusps on Xo{N){C) we have a 
surjection: 

Hi{Xo{N), cusps, Z) Hi{X+{N){C), cusps, Z). 

The kernel of this map consists of the elements [7] in Hi (Xq (N) , cusps , Z) 
satisfying l^iv([7]) = —[7]- So modular symbols methods allow us to 
compute Hi{X^{N){C), cusps, Z) as a quotient of M2(ro(iV)). Let 
]B^(ro(A^)) be the free abelian group on the cusps of Xq{N){C) and de- 
fine: 

S: //i (Xo+(iV)(C), cusps, Z) ^B+(ro(iV)), {a,f3} ^ {/?} - {«}• 
Then Hi{X+{N){C)) = ker((5). 
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Chapter Seven 



Polynomials for projective representations of level 
one forms 

J. Bosman 



7.1 EVTRODUCTION 

In this chapter we exphcitly compute mod-£ Galois representations attached 
to modular forms. To be precise, we look at cases with £ < 23 and the 
modular forms considered will be cusp forms of level 1 and weight up 
to 22. We present the result in terms of polynomials associated with the 
projectivised representations. As an application, we will improve a known 
result on Lehmer's non-vanishing conjecture for Ramanujan's tau function 
(see [Leh, p. 429]). 

To fix a notation, for any G Z satisfying dimS'fc(SL2(Z)) = 1 we will 
denote the unique normahsed cusp form in 5fc(SL2(Z)) by A^. We will 
denote the coefficients of the gi-expansion of Afc by rfc(n): 

Afe(z) = 5;rfc(n)g"G5fe(SL2(Z)). 

n>l 

From dimS'jk(SL2(Z)) = 1 it follows that the numbers Tk{n) are integers. 
For every Ak and every prime £ there is a continuous representation: 

PA„e- Gal(Q/Q) ^ GL2(F,) 

such that for every prime p ^ £we have that the characteristic polynomial of 
PAj./(Frobp) is congruent to — Tk{p)X + p^~^ mod £. For a summary 
on the exceptional representations Mj, / and the corresponding congruences 
for Tk{n), see [Swi]. 



bookarxiv March 23, 2010 



170 CHAPTER? 

7.1.1 Notational conventions 

Throughout this chapter, for every field K we will fix an algebraic closure 
K and all algebraic extension fields of K will be regarded as subfields of K. 
Furthermore, for each prime number p we will fix an embedding Q ^ Qp 
and hence an embedding Gal(Qp/Qp) ^ Gal(Q/Q), whose image we call 
Dp. We will use Ip to denote the inertia subgroup of Gal(Qp/Qp). 

All representations (either linear or projective) in this chapter will be 
continuous. For any field K, a linear representation p: G— )• GL„(if) de- 
fines a projective representation p: G— ;'PGL„(K) via the canonical map 
GL„(K)->PGL„(i^). We say that p: G^PGL„(K) is irreducible if the 
induced action of G on P"^^(K) fixes no proper subspace. So for n = 2 
this means that every point of ¥^[K) has its stabiliser subgroup not equal 
toG. 

7.1.2 Statement of results 

7.1.3 Theorem For every pair [k, t) occurring the table in Section 7.5, let 
the polynomial ^ be defined as in that same table. Then the splitting field 
of each Pk^^ is the fixed field of Ker(pAfc ,e) and has Galois group PGL2 (F^) . 
Furthermore, if a G Q is a root of Pk,e then the subgroup of Gal(Q/Q) 
fixing a corresponds via PAk,e to a subgroup of PGL2(F^) fixing a point 
of pi(F^). 

For completeness we also included the pairs {k, £) for which p^.^£ is isomor- 
phic to the action of Gal(Q/Q) on the ^-torsion of an elliptic curve. These 
are the pairs in the table in Section 7.5 with £ = k — 1, as there the rep- 
resentation is the ^-torsion of Jo{i), which happens to be an elliptic curve 
for ^ G {11,17, 19}. A simple calculation with division polynomials [Lan5, 
Chapter II] can be used to treat these cases. In the general case, one has to 
work in the more complicated Jacobian variety Ji{£), which has dimension 
12 for £ = 23 for instance. 
We can apply Theorem 7.1.3 to verify the following result. 

7.1.4 Corollary The non-vanishing of T{n) holds for all n such that: 



n < 22798241520242687999 ^ 2 • 10^^. 
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In [Jo-Ke], the non-vanishing of T(n) was verified for all n such that: 

n < 22689242781695999 ^ 2 ■ 10^^ 

To compute the polynomials, the author used the approach described in 
Section 6.4. After the initial computations some of the polynomials had 
coefficients of almost 2000 digits, so reduction techniques were absolutely 
necessary. The used algorithms do not give a proven output, so we have to 
concentrate on the verification. We will show how to verify the correctness 
of the polynomials in Section 7.3 after setting up some preliminaries about 
Galois representations in Section 7.2. In Section 7.4 we will point out how 
to use Theorem 7.1.3 in a calculation that verifies Corollary 7.1.4. All the 
calculations were perfomed using Magma (see [Magma]). 

7,2 GALOIS REPRESENTATIONS 

This section will be used to state some results on Galois representations that 
we will need in the proof of Theorem 7.1.3. 

7.2.1 Liftings of projective representations 

Let G be a topological group, let K he a topological field and let 
p: G ^ PGL„(A') be a projective representation. Let L be an exten- 
sion field of K. By a lifting of p over L we shall mean a representation 
p: G ^ GL„(L) that makes the following diagram commute: 

G ^PGL„(i^) 

p 

GL„(L) »PGL„(L) 

where the maps on the bottom and the right are the canonical ones. If the 
field L is not specified then by a lifting of p we shall mean a lifting over K. 

An important theorem of Tate arises in the context of liftings. For the 
proof we refer to [Ser6, Section 6]. Note that in the reference representations 
over C are considered, but the proof works for representations over arbitrary 
algebraically closed fields. 
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7.2.2 Theorem (Tate) Let p: Gal(Q/Q) PGL„(i^) be a projective 
representation of Gal(Q/Q) over a field K. Then for each prime number p, 
there exists a lifting p'^: Dp ^ GL„(K) of If these liftings p'p have 
been chosen so that all but finitely many of them are unramified, then there 
is a unique lifting p : Gal(Q/Q) — )• GL„(if) such that for all primes p we 
have: 

P\ip = p'plip- 

7.2.3 Lemma Let p be a prime number and let K be a field. Suppose that 
we are given a projective representation pp-. Gal(Qp/Qp) — > PGL„(K) 
that is unramified. Then there exists a lifting pp : Gal(Qp/Qp) GL„(K) 
of pp that is unramified as well. 

Proof Since p is an unramified representation of Gal(Qp/Qp), it factors 
through Gal(Fp/Fp) = Z and is determined whenever we know the im- 
age of Frobp G Gal(Fp/Fp). By continuity, this image is an element of 
PGL„(K) of finite order, say of order m. If we take any lift F of p(Frobp) 
to GLn{K) then we have = a for some a G K^. So F' := a'^F, 
where a e K is any m-th root of a, has order m in GL„(K). Hence the 
homomorphism Gal(Qp/Qp) GL„(K) obtained by the composition: 

Gal(Qp/Qp) Gal(Fp/Fp) Z Z/mZ GLn(K) 
hfts p and is continuous as well as unramified. □ 

7.2.4 Serre invariants and Serre's conjecture 

Let ^ be a prime. A Galois representation p: Gal(Q/Q) GL2(F^) 
has a level N{p) and a weight k{p). The definitions were introduced by 
Serre (see [Ser9, Sections 1.2 & 2]). Later on, Edixhoven found an im- 
proved definition for the weight, see [Edil, Section 4]. The definitions 
agree in the cases of our interest, but in the general formulation of The- 
orem 7.2.7 later on, Edixhoven's definition applies. The level N{p) is 
defined as the prime-to-£ part of the Artin conductor of p and equals 1 
if p is unramified outside i. The weight is defined in terms of the local 
representation p\d(', its definition is rather lenghty so we will not write 
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it out here. When we need results about the weight we will just state 
them. Let us for now mention that one can consider the weights of the 
twists p ® X of a representation p: Gal(Q/Q) — ^ GL2(Ff) by a character 
X'- Gal(Q/Q) ^ F^. If one chooses % so that k{p ® %) is minimal, then 
we always have l<A;(p(8)x)<^+l and we can in fact choose our x to 
be a power of the mod I cyclotomic character 

Serre conjectured [Ser9, Conjecture 3.2.4] that if p is irreducible and odd, 
then p belongs to a modular form of level N{p) and weight k{p). Oddness 
here means that the image of a complex conjugation has determinant —1. A 
proof of this conjecture in the case N{p) = 1 has been published by Khare, 
building on ideas of himself and Wintenberger: 

7.2.5 Theorem (Khare & Wintenberger, [Kha, Theorem 1.1]) Let(. be a 
prime number and let p: Gal(Q/Q) — > GL2(F£) be an odd irreducible 
representation of level N{p) = 1. Then there exists a modular form f of 
level 1 and weight k{p) which is a normalised eigenform and a prime A | £ 
of Kf such that p and Jif x become isomorphic after a suitable embedding 
of¥xinto¥i. 

7.2.6 Weights and discriminants 

If a representation p: Gal(Q/Q) — ^ GL2(F£) is wildly ramified at £ it is 
possible to relate the weight to discriminants of certain number fields. In 
this subsection we will present a theorem of Moon and Taguchi, [Mo-Ta, 
Theorem 3], on this matter and derive some results from it that are of use to 
us. 

7.2.7 Theorem (Moon & Taguchi) Consider a wildly ramified representa- 
tion from p: Gal(Q^/Q£) GL2(F£). Leta G Z besuch that k{p ® xj'^) 
is minimal where xi '■ Gal(Q^/Q£) — )• F^ is the mod £ cyclotomic charac- 
ter. Put k = k{p®Xi°')' d = gcd(a, k — l,£—l) and define m in Z by 

— Ker(p) 

letting £^ be the wild ramification degree of K := over Q^. Then 

we have: 




k-l+d 
2 



if2<k<e, 

ifk = e+l, 
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where T^k/q^ denotes the different of K over and vi is normalised by 

Viii) = 1. 

We can simplify this formula to one which is useful in our case. In the 
following corollaries denotes a valuation at a prime above £ that is nor- 
malised by V£{i) = 1. 

7.2.8 Corollary Let p: Gal(Q/Q) PGL2(F^) be an irreducible projec- 
tive representation that is wildly ramified at i. Take a point in F^{¥£), let 
H c PGL2(F^) be its stabiliser subgroup and let K be the number field 
defined as: 

Then the ^-primary part of Disc (K/Q) is related to the minimal weight k of 
the liftings of p by the following formula: 

V£{T)isc{K/^)) = k + £-2. 

Proof Let p be a lifting of p of minimal weight. Since p is wildly ramified, 
after a suitable conjugation in GL2{¥£) we may assume: 



(7.2.9) p\i, 



1 



where : — > denotes the mod £ cyclotomic character; this follows 
from the definition of weight. The canonical map GL2(F^) PGL2(F£) 
is injective on the subgroup (*j so the subfields of cut out by p\j^ 
and pI/^ are equal, call them i^2- Also, let Ki C K2 be the fixed field of 
the diagonal matrices in Im p\j^. We see from (7.2.9) that in the notation of 
Theorem 7.2.7 we can put a = 0, m = 1 and d = gcd(£ — l,k — 1). So we 
have the following diagram of field extensions: 
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The extension K2 / Ki is tamely ramified of degree {C, — l)/d hence we have: 

Consulting Theorem 7.2.7 for the case 2 < k < £ now yields 

k-1 _k-l + d e-l-d _k + £-2 

^ l-l" {£-1)1 J 
and also in the case /c = £ + 1 we get: 

1 2 1 — 2 k + £ — 2 

Ve{VK,/QJ^) = 2 + ^^-^ - ^^-^ - ^^-^ = J . 

— Ker(5) 

Let L be the number field Q . From the irreducibility of p and the 
fact that Im p has an element of order £ it follows that the induced action of 
Gal(Q/Q) on P^(F£) is transitive and hence that L is the normal closure of 
K in Q. This in particular implies that K/Q is wildly ramified. Now from 
[K : Q] = £ + 1 it follows that there are two primes in K above £: one 
is unramified and the other has inertia degree 1 and ramification degree £. 
From the considerations above it now follows that any ramification subgroup 
of Gal(L/Q) at i is isomorphic to a subgroup of (* *) C GL2(F£) of order 
{£ — l)£/d with d I ^ — 1. Up to conjugacy, the only subgroup of index i is 
the subgroup of diagonal matrices. Hence Ki and are isomorphic field 
extensions of Q™, from which: 

ve{Bisc{K/Q)) = i;^(Disc(iCi/Qr)) = ^ • ve{VK,/Qf) = k + £-2. 
follows. □ 

7.2.10 CoroUary Letp : Gal(Q/Q) PGL2(F£) be an irreducible pro- 
jective representation and let p be a lifting of p of minimal weight. Let K 
be the number field belonging to a point of P^(F^), as in the notation of 
Corollary 7.2.8. Ifk>3 is such that: 

Vi{Bisc{K/Q)) = k + £-2 

holds, then we have k{p) = k. 

Proof From'i;^(Disc(K/Q)) = k+£-2 > £+1 it follows thatpis wildly 
ramified at £ so we can apply Corollary 7.2.8. □ 
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7.3 PROOF OF THE THEOREM 

To prove Theorem 7.1.3 we need to do several verifications. We will de- 
rive representations from the polynomials Pj^^^ and verify that they satisfy 
the conditions of Theorem 7.2.5. Then we know there are modular forms 
attached to them that have the right level and weight and uniqueness follows 
then easily. 

First we we will verify that the polynomials Pk,e from the table in 
Section 7.5 have the right Galois group. The algorithm described in 
[Ge-Kl, Algorithm 6.1] can be used perfectly to do this verification; proving 
A^+i ^ Gal(Pjfc,^) is the most time-consuming part of the calculation here. 
It turns out that in all cases we have: 

(7.3.1) Gsl{Pk,e) = PGL2(F^). 

That the action of Ga\{Pk/) on the roots of Pk,e is compatible with the 
action of PGL2(F£) follows from the following lemma. 

7.3.2 Lemma Let £ be a prime and let G be a subgroup of PGL2(F£) of 
index £+1. Then G is the stabiliser subgroup of a point in (F^). In partic- 
ular, any transitive permutation representation of PGL2(F^) of degree £+1 
is isomorphic to the standard action on F^{¥£). 

Proof This follows from [Suz, Proof of Theorem 6.25]. □ 

So now we have shown that the second assertion in Theorem 7.1.3 follows 
from the first one. 

Next we will verify that we can obtain representations from this that 
have the right Serre invariants. Let us first note that every automor- 
phism of the group PGL2(F^) is an inner automorphism. This implies 
that for every P^^, two isomorphisms (7.3.1) define isomorphic represen- 
tations Gal(Q/Q)— >PGL2(F£) via composition with the canonical map 
Gal(Q/Q)-» Gai{Pk/)- In other words, every P^ ^ gives a projective rep- 
resentation p: Gal(Q/Q)^PGL2(F£) that is well-defined up to isomor- 
phism. 

Now, for each {k,£) in the table in Section 7.5, the polynomial Pk,e is 
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irreducible and hence defines a number field: 

Kk,e := Q[x]/{Pk,e), 

whose ring of integers we will denote by 0^/. It is possible to compute 
Ok^e using the algorithm from [Bu-Le, Section 6] (see also [Bu-Le, The- 
orems 1.1 & 1.4]), since we know what kind of ramification behaviour to 
expect. In all cases it turns out that we have: 

We see that for each {k,£) the representation ^ is unramified outside 
i. From Lemma 7.2.3 it follows that for each p ^ £, the representation 
Pk,e\Ga.\{Q /Qp) ™ unramified lifting. Above we saw that via p^^^ the 
action of Gal(Q/Q) on the set of roots of P^/ is compatible with the ac- 
tion of PGL2(F£) on pi(F^), hence we can apply Corollary 7.2.10 to show 
that the minimal weight of a lifting of equals k. Theorem 7.2.2 now 
shows that every p^ £ has a lifting p^/ that has level 1 and weight k. From 
Im pk/ = PGL2(F^) it follows that each pk^£ is absolutely irreducible. 

To apply Theorem 7.2.5 we should still verify that pk^e is odd in each 
case. I thank Robin de Jong for pointing out that this is immediate: Since 
the weight of pk/ is k, we have det Pk,e\ie = Xe~^\ii where xe is the mod 
i cyclotomic character. Now, det pk,e\Dp is unramified for p ^ I and hence 
det pk,e, must equal x\~^ on all of Gal(Q/Q) (apply Theorem 7.2.2 with 
n = 1 for instance). But then, since k is even, we have that det py^^i evalu- 
ated at a complex conjugation equals —1 hence pk/ is odd. 

So now that we have verified all the conditions of Theorem 7.2.5 we re- 
mark as a final step that all spaces of modular forms S'fc(SL2(Z)) involved 
here are 1-dimensional. So the modularity of each p^^^ implies immediately 
the isomorphism pj^^^ = 'P/^^p hence also p^/ = p^^/ ' which completes 
the proof of Theorem 7.1.3. 

7.4 PROOF OF THE COROLLARY 

If r vanishes somewhere, then the smallest positive integer n for which T(n) 
is zero is a prime. This was observed by Lehmer [Leh, Theorem 2] and 
can also be seen using the following argument: Suppose n is the smallest 
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positive integer with r(n) = 0. From the multiplicative property of r it 
follows that n is a power of a prime p. If r(p) / then from \t(p)\ < 
and the recursion for t{p'^) it follows that Vp{T{p'^)) = r ■ Vp{T{p)) for all 
r, so t{p^) would never be zero. 

Using results on the exceptional representations for t{p), Serre pointed 
out [Ser8, Section 3.3] that if p is a prime number with r(p) = then p can 
be written as: 



In fact p is of this form if and only if t{p) = mod 23 • 49 • M holds. 
Knowing this, we will do a computer search on these primes p and verify 
whether t{p) = mod ^ for ^ G {11, 13, 17, 19}. To do that we will use 
the following lemma. 

7.4.1 Lemma Let K he a field of characteristic not equal to 2. Then the 
following conditions on M e GL2 (K) are equivalent: 

(1) trM = 0. 

(2) For the action of M on (K), there are or 2 orbits of length 1 and 
all other orbits have length 2. 

(3) The action of M on ¥^{K) has an orbit of length 2. 

Proof We begin with verifying (1) => (2). Suppose tr M = 0. Matrices of 
trace in GL2(i^) have distinct eigenvalues in K because of char(Er) 7^ 2. 
It follows that two such matrices are conjugate if and only if their character- 
istic polynomials coincide. Hence Af and M' := (^_dotj\^ are conjugate 
so without loss of generality we assume M = M'. Since is a scalar ma- 
trix, all the orbits of M on F^{K) have length 1 or 2. If there are at least 3 
orbits of length 1 then if ^ itself is an eigenspace of M hence M is scalar, 
which is not the case. If there is exactly one orbit of length 1 then M has a 



p = hM-l 



with 




bookarxiv March 23, 2010 



POLYNOMIALS FOR PROJECTIVE REPRESENTATIONS OF LEVEL ONE FORMS 1 79 

non-scalar Jordan block in its Jordan decomposition, which contradicts the 
fact that the eigenvalues are distinct. 

The impUcation (2) (3) is trivial so that leaves proving (3) (1). Sup- 
pose that M has an orbit of length 2 in F^{K). After a suitable conjuga- 
tion, we may assume that this orbit is {[(q)], [(°)]}. But this means that 
M ~ (° o) for certain a, 6 G if hence trM = 0. □ 

In view of the above lemma it follows from Theorem 7.1.3 that for 
i e {11, 13, 17, 19} and p 7^ ^ we have r(p) = mod £ if and only if the 
prime p decomposes in the number field Q[x]/{Pi2,e) as a product of primes 
of degree 1 and 2, with degree 2 occurring at least once. For p j Disc(Pi2,^), 
which is a property that all primes p satisfying Serre's criteria possess, we 
can verify this condition by checking whether Pi2,e has an irreducible factor 
of degree 2 over ¥p. This can be easily checked by verifying: 

x^^ = x and xF i^x in Fp[x]/(Pi2/). 

Having done a computer search, it turns out that the first few prunes satis- 
fying Serre's criteria as well as t(p) = mod 11 • 13 • 17 • 19 are 

22798241520242687999, 60707199950936063999, 
93433753964906495999, 102797608484376575999. 

Remark. The unpublished paper [Jo-Ke] in which Jordan and Kelly ob- 
tained the previous bound for the verification of Lehmer's conjecture seems 
to be unfindable. Kevin Buzzard asked me the question what method they 
could have used. If we weaken the above search to using only the prime 

^ = 11 we obtain the same bound as Jordan and Kelly did. So our specula- 
tion is that they searched for primes p satisfying Serre's criteria as well as 
t(j)) = mod 11. This congruence can be verified using an elUptic curve 
computation, as was already remarked in Subsection 7.1.2. 

7.5 THE TABLE OF POLYNOMIALS 

In this section we present the table of polynomials that is referred to through- 
out this chapter. 
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Polynomials belonging to projective modular representations 



(k £) 




(12,11) 


yXi _ 4^11 _^ 55^9 _ ;l65x8 + 264x^ - 341^6 + 330x^ 
- 165x^ - 55x3 _^ 99^.2 _ ^-^x - 111 


fl2 IS") 


a.14 _|_ 7^13 _|_ 26x^^ + 78x^^ + 169t^° + 52x^ — 702x^ 
- 1248x^ + 494x6 + 2561x5 + 312x^ - 2223x3 
+ 169x2 + 506x - 215 


(12,17) 


x^^ - 9x1^ + 51x^6 - 170x^5 + 374x1'' - 578x^3 
+ 493ri2 — QOlr^i + 578t1° — 51r^ + 986r^ + 1105r''' 
+ mx^ + 510x5 + 119x4 + 68x3 _^ 3Qg^2 ^ 273x + 76 


(12,19) 


2.20 _ 7^19 _^ 7g^i7 _ 3g3.i6 _ 380,t15 + 114x^4 
+ 1121x^3 _ 798a,i2 „ i425x^^ + Gbllx^^ + 152x^ 

- 19266x'^ - llOgex'^ + 16340x6 + 37240x5 + 30020x'' 

— 17841x3 _ AJAA^x'^ — 31323x — 8055 


(16,17) 


^18 _ 2a;i7 _ i7a.i5 + 204x^4 - 1904x^3 + sebbx^"^ 
+ 5950x^1 - 3672x1° - 38794x'^ + 19465x^ + 95982x'^ 

- 280041x6 - 206074x5 + 455804x4 + 946288x3 

- 1315239x2 + 606768X - 378241 


(16,19) 


^20 _^ ^19 _^ 57^18 _^ 3g2;i7 + 950a;i6 + 4389x^5 
+ 20444x^4 + 84018x^3 _^ 130359x^2 _ 4902xi^ 
— 93252x1° 1 75»4Sa.9 _ io4l219x® — 1219781x'^ 
+ 3225611x6 + 1074203x5 - 3129300x4 - 2826364x3 
+ 2406692x2 + 6555150x - 5271039 


(16,23) 


x24 + 9x23 + 46x22 + 115x2^ - 138x2° - 1886x1^ 
+ 1058x1^ + 59639x1^ + 255599x^6 + 308798x^5 

- 1208328x14 - 6156732x13 - 10740931x12 
+ 2669403x11 + 52203054x1° + 106722024x9 
+ 60172945x*^ - 158103380x^ - 397878081x6 

- 357303183x5 + 41851168x4 + 438371490x3 
+ 484510019x2 + 252536071X + 55431347 



Continued on next page 
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Table continued from previous page 





Pk,e 


(18,17) 


x^^ - Ix^'^ + 17x^6 + 17x^^ - 935x1'' ^ 799^13 
+ 9231x^2 _ 4i463a;ii + 192780x1° + 291686x9 

— 39U014X + d13z223x — 3955d45x + 2yiDll2x 
+ 45030739x4 - 94452714x3 + 184016925x2 

- 141466230X + 113422599 


(18,19) 


x^o + lOx^^ + 57x1^ + 228x1"^ - 361x1^ - 3420xi^ 
+ 23446x^4 + 88749x^3 - 333526x1^ - 1 138233x^1 
+ 1629212x1° + 13416014x9 + 7667184x^ 

- 208954438x^ + 95548948x6 + 593881632x5 

— loOol/OoOix — lozdoibozDX + z205335301x 
+ 1251488657X - 8632629109 


(18,23) 


x^^ + 23x^2 - 69x^1 - 345x^0 - 483x1^ - 6739xi^ 
+ 18262x1'^ + 96715xi'5 _ 349853x15 + 2196684x1"^ 

- 7507476x1=^ + 59547x^2 + 57434887xii 

- 194471417x1° + 545807411x9 + 596464566x^ 

- y923o77oy7x + ooyil40iyDox — yzoiOYoyiUox 
+ 157585411007x4 - 171471034142x3 

+ 237109280887x2 - 93742087853x + 97228856961 


(20, 19) 


^20 _ 5^19 _^ 7g2,i8 _ 247a;i7 + \mx^^ - 8474x1^ 
+ 15561x^4 _ 112347x13 + 325793x1^ - 787322xii 
+ 3851661x1° - 5756183x9 + 20865344x8 

- 48001353x^ + 45895165x6 - 245996344x5 
+ 8889264x4 - 588303992x3 - 54940704x2 

- 538817408X + 31141888 



Continued on next page 
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Table continued from previous page 







(20, 23} 


24 23 rio 22 -I OA 21 cia'y 20 cc/io 19 

X — X — 23x — 184a; — 667x — 5543x 

- 22448x^^ + 96508x1^ + 1855180x^6 

+ 13281488x^^ + 66851616x^'' + 282546237x^3 

+ 1087723107x12 + 3479009049x^1 + 8319918708x^0 

+ 8576048755x9 - 19169464149x8 - 111605931055x'^ 

- 227855922888x6 - 193255204370x5 
+ 176888550627x^ + 1139040818642x3 
+ iuooouyooz4zox + iouu4ozoiyouyx 
+ 314072259618 


(22, 23) 


^24 _ 2^23 _^ ii5a;22 232;2i + 1909x20 + 22218x19 
+ 9223x18 + 121141x1^ + 1837654x1^ - 800032x1^ 
+ 9856374x1"^ + 52362168x1^ - 32040725x1^ 
+ 279370098x11 + 1464085056x1° + 1129229689x9 
+ 3299556862x^ + 14586202192x'^ + 29414918270x6 
+ 45332850431x5 - 6437110763x'' - 111429920358x3 
- 12449542097x2 + 93960798341x - 31890957224 
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Chapter Eight 



Description of Xi(5/) 

B. Edixhoven 



8.1 CONSTRUCTION OF A SUITABLE CUSPIDAL DIVISOR ON Xi {51} 

In this section we put ourselves in the situation of Theorem 2.5.12: I is a 
prime number, k is an integer such that 2 < k < l+l, and / is a surjective 
ring morphism T(l, /c) — F a with F a finite field of characteristic such 
that the associated Galois representation p: Gal(Q/Q) — GL2(F) is irre- 
ducible. We let V denote the two-dimensional F-vector space in Ji(l){Q)[l] 
that reaUses p. 

As explained in Chapter 3, we would Uke to have an effective divisor 
Dq on Xi{1)q of degree the genus of Xi{l) such that for all non-zero x in 
the submodule V of Ji{l){Q) we have hP{£x{Do)) = 1- It would be nice 
to have a cuspidal divisor (i.e., a divisor supported on the cusps) with this 
property. The first complication is that the cusps are not all rational over Q: 
half of them have the maximal real subfield of Q(0) as field of definition. 
Moreover, even working with all the cusps, we have not succeeded to find 
a cuspidal divisor Dq with the desired properties. On the other hand, below 
we will give exphcitly a cuspidal divisor Do on the curve Xi{51)q(^q) that 
has the property that {Cx{Dq)) = 1 for each x in Ji(5/)(Q) that spe- 
cialises to at some place of Q over /. In particular, Dq has the required 
property for V embedded in Ji (5/) (Q) in an arbitrary way, provided that the 
image of p contains SL2(F) (this will be shown in Section 8.2). We have 
chosen to work with Xi(5/), but the same method will work for modular 
curves corresponding to some level structure if the prime to I part of the 
level structure is fine, and of genus zero. 
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For the rest of this section, our assumptions are the following: I is a prime 
number, not equal to 5. We let X := Xi{5l)q(^Q-^ over The genus 

of X is (Z — 2)^. References for facts about X that we use can be found 
in [Gro], and also in [Edil]; they are derived from results in [De-Ra] and 
in [Ka-Ma]. 

The curve Xo(5)q has 2 cusps, both Q-rational, called and oo (after 
the points of (Q) of which they come). The cusp oo has as moduli in- 
terpretation the degenerate elliptic curve (generalised elliptic curve in the 
terminology of [De-Ra]): the 1-gon, equipped with the unique subgroup 
of order 5 of Gm- The cusp corresponds to the 5-gon, equipped with a 
subgroup of order 5 that meets all 5 components. The group Fg acts (as 
diamond operators) on Xi{5), with quotient Xo(5); the subgroup {(±1)} 
acts trivially, and the quotient /{(itl)} by this subgroup acts faithfully. 
The inverse images of and oo both consist of two cusps. Those over 
are Q-rational (the subgroup of order 5 of the 5-gon is the constant group- 
scheme Z/5Z), whereas those over oo are conjugated over Q(V5). We fix 
one Q-rational cusp c of Xi{5). 

The group F^^ acts faithfully, and in fact, even freely, on X. The set of 
cusps of X over the cusp c of -^^1(5) form two F^^ -orbits, corresponding to 
the type of degenerate elliptic curve that they correspond to: 5-gon or 51- 
gon. The orbit corresponding to the 5-gon consists of points rational over 
QiCi), all conjugates of each other. The orbit corresponding to the 5Z-gon 
consists of Q-points. 

We let J denote the Jacobian of X. What we want is an effective divisor 
Dq of degree gonX (with g the genus of X), supported on the cusps over c, 
such that for all x in J(Q) that specialise to at some place of Q over I we 
have {Xq, jCx{Do)) = 1- For the notion of specialisation we use Neron 
models; the reader is referred to [Bo-Lu-Ra] for this notion. For x in J{K) 
with K C Qa. finite extension of Q(C;), and A a place of Q over I, we say 
that X specialises to at A if x, viewed as element of Jok{Ok), with Jo^ 
the Neron model of J over Ok, specialises to at the place of K given 
by A. For K d K' di finite extension we have J{K) c J{K'), hence we 
can also view x as element of J{K'). The notion of x specialising to zero 
is the same for K and K', because Jz[C(] is semi-stable at I. 

The moduli interpretation of X gives a semi-stable model Xz[^;,i/5] over 
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1/5], described in [Gro] for example. A result of Raynaud identifies 
the connected component of the Neron model Jqk with the connected com- 
ponent of the Picard scheme of Xq^ (see Section 9.5 of [Bo-Lu-Ra]). This 
means that for x in J{K) specialising to at A the hne bundle Cx on 
associated with x can be extended uniquely over the local ring Ok,\ to a 
line bundle Cx on ^ such that the restriction Cx of Cx to the special 
fibre is trivial. The divisor Dq on Xk extends, by taking the Zariski 
closure, to an effective Cartier divisor on Xqi^ ^ ■ 

We now note that h^{XK, Cx{Do)) is at least one, by Riemann-Roch, 
and that h'^{XK, Cx{Dq)) is at most h^{Xv^ , Cx{Dq)) by semi-continuity 
of cohomology of coherent sheaves. As Cx{Dq)) = 0{Do), it now suffices 
to take Do such that h'^{X^^,0(D^)) = 1. We do this by looking at the 
geometry of X^^ . As '^[Ci] has a unique morphism to F^, the curve X^^ does 
not depend on K. The scheme of cusps of Xi^^q] is finite etale over 
hence the cusps lying over c specialise injectively to . 

The curve is the union of two irreducible components, Xi and X2, 
say, both isomorphic to the Igusa curve of level / over Xi(5) over F;, 
that meet transversally in the set S of supersingular points. We will take 
Do = Di + D2, with Di on Xi and D2 on X2; note that the cusps are 
disjoint from E, so Do lies in the smooth locus of X^^. 

In order to simplify the notation, we let X and Dq denote Xf^ and Dq, 
from now on, in this section. We let be the dualising sheaf on X (see 
Section 8 of [Gro], or [Ma-Ri]): it is the invertible Ox-module obtained 
by gluing (S) and Q,]^^ (S) along S via the residue maps at the points 
of S on Xi and minus the residues maps at the points of S on X2. By 
Riemann-Roch, what we want is that h^{X,0{Do)) = 0, and hence, by 
Serre duahty, that /i°(X, ^0)) = 0. In other words, an element of 
lP{X,nx) that vanishes on Do must be zero. Restriction to Xi gives a 
short exact sequence: 

^ R\X2,n]^^^^^{-D2)) ^ ii%x,nxi-Do)) ^ 

Hence, it suffices to take Di such that H°(Xi, fi^^^- (E-Di)) = and 
such that H'^(X2, Ol, ,= {—D2)) = 0. Let us now first see of which degrees 
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di and d2 we want to take Di and D2. Let gi and §2 be the genera of Xi 
and X2 (note: they are equal). Then we have that g = gi + g2 + — 1, 
and g = degDo = ^1 + ^2- It can be shown in several ways that the 
degree of the sheaf cj on Xi (5)f; is one. Either by exphcit computation, 
using the equations of Proposition 8.2.8, or by the following argument. The 
curve Xi(5)f, over has genus zero. The Kodaira-Spencer isomorphism 
on Xi(5)f;, from — > il^ (Cusps), plus the fact that the divisor of cusps 
has degree 4, give that the degree of u/^^ is 2. Therefore, the Hasse invariant, 
being a global section of has exactly l—l zeros on Xi (5) over F; and 

therefore we have: 

(8.1.1) #S = Z-1. 

Applying Hurwitz's formula to the covering Xi Xi {5)f^ , which is totally 
ramified over S and unramified outside it, gives: 

251 -2 = -2(1-1) + (/-!)(/ -2), 

and hence: 

(8.1.2) 5^ = l(/_2)(/-3). 
This implies that we want to take: 

di=5i + #S-l = ^(Z-l)(Z-2), 

(8.1.3) 2 
d2=g2 = ^{l-2)il-S). 

Now we use equations to compute with. We choose a coordinate z on 
-^^1(5)^^, i.e., an isomorphism from Xi(5)p^ to Pi , such that 2;(S) does 
not contain or 00 and such that z~^0 is the (rational) cusp of Xi(5)p^. 
Let / be the monic polynomial in z whose zeros are the elements of S, each 
with multiplicity one. Then Xi and X2 are both isomorphic to the cover of 
Xi(5)p^ given by the equation = /, by the following argument. The 
complete local rings of Xi at the points of S, with their F^^ -actions, are 
all isomorphic to each other because, by a theorem of Serre and Tate, these 
can all be described in terms of the deformation theory of one Z-divisible 
group over F;; see [Ka-Ma, §5.2-5.3]. There is a general theory of cychc 
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possibly ramified covers such as Xi — )■ Xi{5)f^, based on the decomposi- 
tion of Oxi as O-module on Xi (5)|=^ for the F^^ -action. It shows that the 
cover Xi Xi(5)p^ is the cover of Z— 1th roots of the global section 1 of 
the invertible sheaf 0(E) on Xi(5)p^, in an invertible O-module £ with a 
given isomorphism — > where the F^^-action may have been 

changed by an automorphism of F^^. As Xi{5)f^ has genus zero, we can 
take C to be Ox^ (z^^oo). In fact. Section 12.8 of [Ka-Ma] shows that Xi 
is obtained from Xi (5)|;^ by extracting the Z— 1th root of the Hasse invariant, 
in w. 

We compute a basis of H°(Xi , ^x^^^^ (S)). On Xi we have: 
(8.1.4) -y'-^dy = f'dz. 



Hence {dz)ly^ ^ = —{dy)lf' is a generating section of ^^^yf on the 
affine part given by our equation. Hence {dz)ly^~^ is generating section of 
/f affine part, and it is F^^ -invariant. At each point of Xi 

over the point where z has its pole, both z and y have a simple pole, and 
{dz)/y'-~^ has order — 2 -|- i — 1 = / — 3. So we have a basis: 

(8.1.5) HO(Xi,n^^/^^(S))= ¥iz^^-{dz)/y'-\ 

i+j<l-3 

Note that this agrees with the fact that di = ^{l - - 2). 

We can now say how to choose Di. At each of the I— I points where z 
has a zero we must give a multiplicity. In the coordinate system given by z 
and y, these points are the ones of the form (0, b) with b G Ff satisfying 
= /(O). Here is how we choose Di: just distribute the multiplicities 
(0, 1 , . . . , Z — 2) over these points. Then one sees that any linear combination 
of our basis elements that vanishes on Di is zero, as follows. At all points 
oi Di, z has a simple zero. Let uj be an element of H'^(Xi, ,- (S)), 

Ai/lf i 

with coordinates Ajj in the basis (8.1.5). Assume that u vanishes on Di 
(taking multiplicities into account). As there are /— 2 points in Di with 
multiplicity > 0, the polynomial ^ojy-'^ being of degree < 1—3, must 
be zero. As there are Z— 3 points in Di with multiphcity > 1, the polynomial 
J2j Xijzy^, being of degree < I— A, must be zero. And so on. 
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Now we do D2. A basis is the following: 

(8.1.6) H0(X2,J^^^/^^)= ¥iz'y^-idz)/y^-'. 

i+j<l-4 

We note that this agrees with 92 = {I — 3)(Z — 2)/2. So, for D2, just 
distribute the multiplicities (0, 0, 1, . . . , Z — 3) over the points where z has 
a zero. The same argument as the one we used for Di shows that any oj in 
}1^(X2, ,-) that vanishes on D2 is zero. 

A 2 /If;' 

We summarise our results. As the action of permutes the two Q- 
rational cusps of Xi(5), our arguments above work for both of them. 

8.1.7 Theorem Let I be a prime number not equal to 5. Let c be one of 

the two Q-rational cusps of Xi(5). Then the cusps of Xi{5l) over c are 
Q{Q) -rational, and consist of two ¥^ -orbits, on which ¥^ acts freely. Let 
Di be a divisor on Xi(5Z)q(^j) obtained by distributing the multiplicities 
(0, 1, — 2) over one of these two orbits. Let D2 be the divisor obtained 
by distributing the multiplicities (0,0, 1, . . . 3) over the other orbit. Then 
Dq := D1+D2 has degree equal to the genus ofXi (5Z) and has the property 
that for any Q-point x of the Jacobian of Xi {51) that speciahses to at some 
place over I we have {Xi(51)-q, Cx{Dq)) = 1. 



8.2 THE EXACT SETUP FOR THE LEVEL ONE CASE 

In Chapter 3 we described our strategy for computing the residual Galois 
representations attached to a fixed newform. That strategy depends on prop- 
erties of divisors Dq and functions / to be chosen, on modular curves of 
varying level. These Dq and / must satisfy a number of conditions. In 
general we do not know how to choose divisors Dq of which we can prove, 
without a computer computation, that they have the required property. This 
is the main reason for which we will now restrict ourselves to just the case 
of modular forms of level one. 

The aim of this section is to describe exactly our strategy for comput- 
ing the residual representations V in the situation of Theorem 2.5.12: I is a 
prime number. A; is an integer such that 2 < A; < and / is a surjective 
ring morphism T(l, A;) — > F a with F a finite field of characteristic I, such 
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that the associated Galois representation p: Gal(Q/Q) — > GL2(F) is irre- 
ducible, under the extra hypothesis that the image of p contains SL2(F). By 
Theorem 2.5.18, this hypothesis holds when p is irreducible and Z > 6A; — 5. 
We let V denote the two-dimensional F- vector space in Ji {I) (Q) [/] that re- 
alises p. 

Theorem 8.1.7 gives us a divisor Do on Xi(5^)q(^j) that we want to use. 
Therefore, we want to embed V into Ji(5Z)(Q)[/]. 

Let vr : Xi (51) — > Xi (/) be the standard map (i.e., the one that forgets the 
5-part of the level structure, the one denoted i?5/,/,i in Section 2.2). Then 
the degree of tt is 5^ — 1 = 24, which is prime to I. This imphes that tt^tt* 
is multiphcation by 24 on Ji{l), and that tt* is injective on Ji{l){Q)[l]. We 
have a projector: 

(8.2.1) ^7r*7r, : Ji(50(Q)W - vr* Ji(0(Q)[/] C Ji(5/)(Q)[/]. 

We will consider V embedded in Ji(5Z)(Q)[Z] via its embedding into 
^i(0(Q)W' followed by tt*. 

8.2.2 Proposition Let I be a prime number, let k be an integer such that 

2 < k < l+l, and f a surjective ring morphism T(l, fe) — >■ F a with F a 
finite field of characteristic I, such that the image of the associated Galois 
representation p: Gal(Q/Q) GL2(F) contains SL2(F). We let V denote 
the puUback as above of the two-dimensional F- vector space in Ji{l){Q)[l] 
thatrealises p. LetDo be a divisor on Xi{51)q(^(^^-) asgivenin Theorem 8.1.7. 
Then, for every x in Vi, wehave hP {Xi{51)q, Cx{Do)) = 1- 

Proof In view of Theorem 8.1.7, it suffices to show that for each x in 
V there is a place of Q over I at which x specialises to 0. The notion 
of specialisation is explained in Section 8.1. Let Ji[q] denote the Neron 
model of J := Ji(5Z) over Then V is the group of Q-points of an 

F- vector space scheme Vq(q) in Jq((i)- Let V be the Zariski closure of 
Vqi^q) in Jz[(i]- Then it is shown in Section 12 of [Gro] and in Section 6 
of [Edil] that Vz.i[q] is finite locally free over and that the dimension 

as F-vector space scheme of the local part of Vzi[Ci] is 1 if / (21) 7^ and 
2 if /(T/) = 0. We note that it does not matter if we take Zariski closure 
in Ji (Z) or in Ji {51), as tt* gives a closed immersion of the Z-torsion of Ji (1) 
over Zi into that of Ji(5Z). 
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This means that at each place of Q over / there is a non-zero x in V 
that specialises to 0. Under our assumptions, the image of Gal(Q/Q(0)) 
acting on V is SL(F). Hence Gal(Q/Q(Ci)) acts transitively onV - {0}. 
Hence for each xinV — {0} there is at least one place of Q over I where x 
specialises to 0. □ 

The fact that our divisor Dq lives on Xi(5/)q(^j), and not on Xi{51)q, forces 
us to work over Q{Q), and not over Q, as in Chapter 3. 

We let Xi denote Xi(bl)Q and gi its genus, and we let ^;,Q(f() denote the 
Q(0)-algebra that corresponds to the Gal(Q/Q(0))-set V. In order to ex- 
plain the notation ^i,Q(^(), we note that this Q(0)-algebra is obtained from 
the Q-algebra Ai (that corresponds to the GaI(Q/Q)-set V) by extension of 
scalars. 

Proposition 8.2.2 gives that for each x in V there is a unique effective 
divisor = YlfLi Qx,i of degree gi on q such that x = [D^ - Dq] 
in Ji{Q). Note that, for a; = 0, it is indeed true that = Dq, hence 
the two notations are consistent. The following observation will make the 
exposition in Chapter 12 somewhat easier. As for each x 'vaV specialises 
to at some place of Q above I, the divisor speciaUses to the cuspidal 
divisor Dq at such a place, and hence none of all Qx,i can be a CM-point, in 
particular: 

(8.2.3) for all x and i: j{Qx,i) ^ {0, 1728}. 
The uniqueness of Dx implies that: 

(8.2.4) Dgx = gDx, for all x in F and 5 in Gal(Q/Q(0)). 
We write each Dx as: 

(8.2.5) Dx = Df' + L>™^P, 

where D'^^^ is supported on the cusps of q and where D^ is disjoint 
from the cusps. The next lemma shows that D^^ determines x, and its proof 
uses only that p is absolutely irreducible, not that its image contains SL2 (F) . 

8.2.6 Lemma In this situation, the map from V to the set of effective divi- 
sors on Xi Q that sends x to is injective. 
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Proof Suppose that it is not. We take xi and X2 in V, distinct, such that 
D^" = -D^". Then the element xi — X2 in V is nonzero and is repre- 
sented by the cuspidal divisor D^^ — Dx2- The cusps of Xi are rational 
over Q(C5i)- Hence x\ — X2 gives an injection F ^ F of representations of 
Gal(Q/Q(C5i))' where ¥ has trivial action. But that gives, by adjunction of 
induction and restriction, a nonzero map from the regular representation of 
Gal(Q(C50/Q) over F to V, necessarily surjective because V is irreducible. 
But then the image of p: Gal(Q/Q) — > GL2(F) is abehan. As p is odd, 
the two eigenspaces in V of any complex conjugation then decompose V, 
in contradiction with the irreducibility of V. □ 

As the cusps of q form a Gal(Q/Q)-stable subset of q we have: 
(8.2.7) forallffinGal(Q/Q(0)): D^^ = gD^^, D'^^'^ = gD^^'^. 

Hence the map that sends x in V to L>fi° is Gal(Q/Q(0))-equivariant. 

We will now produce a suitable function fi: Xi ^ Pq, in order to push 
the set of \ x e V} injectively and Gal(Q/Q(0))-equivariantly to 

the set {fi^^D^"^ \x eV}of divisors on A^. 

We start by giving an explicit description of the curve Yi{5) over Z[l/5]. 
In order to do that, we determine a universal triple {E/S, P) where E/S 
is an elliptic curve over an arbitrary scheme, and P in E{S) is everywhere 
of order 5, i.e., for every Spec(^) — )■ S with A non-zero, the image of P 
in E{A) has order 5. The base of this triple is the open part ^1(5)' of the 
model 11(5) over Z (constructed in Chapter 8 of [Ka-Ma]) where the P 
has order 5 (i.e., 11(5)' is the complement of the irreducible component of 
Y'i(5)f5 where the point P generates the kernel of Frobenius). The equation 
of this universal triple can also be found on page 7 of Tom Fisher's thesis, 
see [Fis]. 

8.2.8 Proposition Let E/S bean elliptic curve, and P G E{S) a point that 
is everywhere of order 5. Then {E/S, P) arises via a unique base change 
from the following triple: 

' E -.y^ + {b + l)xy + by = x^ + hx'^ 

< yi(5)' = Spec(Z[6, l/discr(£;)]), discr(£;) = -b^{h^ + lib - 1) 
P=(0,0). 



bookarxiv March 23, 2010 



192 CHAPTERS 

The j -invariant of E is given by: 

j{E) = -(6^ + 1263 + 1462 _ 126 + lf/h^{h'^ + 116 - 1). 

Proof Our proof is modelled on Section 2.2 of [Ka-Ma] ; basic properties of 
Weiersti-ass equations for elliptic curves are used witiiout being mentioned. 

Let {E/S, P) be given, with P everywhere of order 5. Choose a param- 
eter t at 0, up to order 2, i.e., a trivialisation of loe/s- Note: we are working 
locally on 5, here; in the end, as we will succeed in making things unique, 
our construction will be global. Note: t is unique up to t' = ut, with u & 
(S = Spec(i?) now). 

Choose X a global function on E — 0{S) such that x = + • ■ ■ . Then 
X is unique wp to x' = x + a, a e R. Make x unique by demanding that 
x{P) = (this is alright because and P are disjoint). 

Choose y = + ■ ■ ■ regular on E' — 0{S). Then y is unique up to 
y' = y + ax + 6. Make y unique by demanding that y{P) = and that the 
tangent of £' at P is the line given by the equation y = 0. (Indeed, use 6 
(uniquely) to get y{P) = 0, then note that the tangent at P is nowhere the 
line given by a; = because P is nowhere annihilated by 2). 

The equation for E is of the form: 

y^ + aixy + a^y = x^ + a2x'^, 

because the coefficients usually called 04 and oe are zero. We also see that 
03 is a unit because E is smooth at (0,0). The coefficient 02 is a unit, 
because P is nowhere annihilated by 3. 

Now we try to get rid of u (the ambiguity in the choice of t). If t' = u~^t, 
then = fai, hence we can make t unique by demanding that 02 = 03. 
We do that, and then we have the following equations. 

The elliptic curve E and the point P are given by: 

y2 + axy + hy = x^ + bx'^, P = (0, 0). 

We have 5-P = 5-0, hence there is a unique f on E — 0{S) of the form: 

f = xy + ay + fix^ + ^x + 5 

such that the divisor of / is 5 P — 5 0. As x and y have order one and 
two, respectively, at P, we have 7 = (5 = 0. The function / with divisor 
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5-P — 5-0 is given by: 

f = xy + ay + fix^. 

Here we know that h, a and /3 are in R^, because vp{x) = 1 and vp{y) = 2 
everywhere on S. Now we have to compute what it means that vp{f) = 5. 
This means that the intersection multiphcity of the two curves E and V{f) 
at (0, 0) is 5. A systematic way to compute that is to do successive blow- 
ups; that works nicely, but we will not do that here. A much faster way to 
do the computation is to take suitable linear combinations of the equations 
for E and / directly. One finds the equations: 

fi = —a, a = a~^b +1, a = 1. 

□ 

The reason we give such a detailed description of Yi (5) is that it gives us 
functions on all the Yi{5l), at least over Z[l/5l], as stated in the following 
proposition. 

8.2.9 Proposition Let I ^ 5 be prime. Let E/Yi{5y be the elliptic curve 
given in Proposition 8.2.8. Then Yi{5l) and E[l] ~ {0} agree over Z[l/5/]; 
for S a Z [1/5/] -scheme and Q in {E[l] - {0}){S) we get, by puUback from 
yi(5)', an elliptic curve overS with an S -valued point P5 that is everywhere 
of order 5, and an S -valued point Pi that is everywhere of order I. In partic- 
ular, the functions b, x and y on E\l\ — {0} give functions hi, Xi and yi on 
Yi(5Z) over Z[1/5Z] that generate its coordinate ring. 

Proof This is standard. The construction above gives a morphism, over 
Z[l/5/], from E[l] — {0} to 1^(5/). Conversely, an elliptic curve over S 
with such points P5 and Pi gives a point of E[l] {0} by the universality 
of 11(5)' and the fact that E[l] is finite etale over Yi{5y away from charac- 
teristic I. The second statement follows from the fact that E[l] — {0} is a 
closed subscheme of the affine scheme E — {0}. □ 

The functions bi, xi and yi on Yi{5l) over Z[l/5/] have the following moduh 
interpretations. For any Z[l/5Z]-algebra A, and any Q in Yi{5l){A), a point 
corresponding to a triple {E, P5, P;) with E an elliptic curve over A, P5 in 
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E{A) a point that is everywhere of order 5 and Pi in E{A) a point that is 
everywhere of order /, there are unique elements hi{Q), xi{Q) and yi{Q) 
in A such that {E/A, P5) is uniquely isomorphic to the pair given by: 

+ {hi{Q) + l)xy + bi{Q)y = + hi{Q)x\ P5 = (0, 0). 
Then, in these coordinates, we have: 

Pi = {xi{Q),yi{Q))- 

Similarly, we define regular functions x'^ and y[ on il(5Z)2[i/5;] by the con- 
dition that, in the coordinates above, we have: 

l-^P^ + Pi = {x\{Q),y[{Q)), 

where l^^P^ is the unique point Q in £'[5](^) with IQ = P5. 

We note that the pair of functions [hi^x'^) embeds ^i(5/)z[i/r5i] in the 
affine plane Indeed, assume that Q and Q' are in Yi{hl){A), 

corresponding to {E,Pf„Pi) and {E',P^,P[), with bi{Q) = bi{Q') and 
^liQ) = ^liQ')- Then, by Proposition 8.2.8, P5) is uniquely iso- 
morphic to {E', P5), and so we simply consider them to be equal. Then, 
r^Ps + Pi and r^P5 + P/ have the same x-coordinate. Hence, locally on 
Spec(^), /-iPs + P/ = ±(/-iP5 + P/). Multiplying by I we see that the 
sign cannot be a minus. 

Using the functions 6; and x'^, we can now say how we will choose the 
function //. We return to the situation right after Lemma 8.2.6. 

For X e V, let dx be the degree of D^^, and let us write as a sum of 
points in ^^(Q) as follows: 

g dx g 

Dx = Y,Qx,i, with Di^ = Y,Q.,i, i^r^= E 

i=l i=l j=da;+l 

We note that do = 0, as Dq is a cuspidal divisor, and that for all non-zero x 
in V the dx are equal, as they are permuted transitively by Gal(Q/Q(C;)). 

The set S of points in A^(Q) consisting of the {hi{Qx,i), x'i{Qx,i)), with 
a; in F and i in {1, ... , dx} has at most g-{#¥)^ elements. We want to 
project S injectively into (Q) with a map of the form {a,b) a + nb for 
a suitable integer n. As there are at most g'^-(#F)^ pairs of distinct elements 
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in S, at most that number of integers n is excluded. Hence there exists an 
integer n with < n < g^-(#F)*^ such that the function fi := hi + nx[ has 
the required property that the fi^^D^^, for a; G F, are all distinct. 

Let /; be such a function. For each x in F, *Z)^" gives us a polynomial 
PdoJux with coefficients in Q given by: 

dx 

PooJuxit) = l[it - fi{Qx,i)) in Q[t]- 

1=1 

Vice versa, each PdoJi,x gives us the divisor fi ^.D^^'' by taking the roots, 
with multiplicity. Therefore, the map that sends x to PdoJi,x is injective, 
and Gal(Q/Q(CO)-equivariant. 

The next step is to "encode" each PdoJi,x in a single element of Q, re- 
specting the action of Gal(Q/Q(C;)). We do this by evaluating at a suitable 
integer m, i.e., by sending PdoJ^x to PdoJi,x{^)- For a given m, this map 
is injective if and only if for any distinct xi and X2'vaV,m is not a root of the 
difference of PdqJuxi and PdoJi,x2- Each of these differences has at most 
g roots, and as there are less than (#F)'^ such differences, there are at most 
(7-(#F)^ integers to avoid. So there is a suitable m with < m < g-{^¥)^. 
Composing our maps, we obtain a generator for the Q((^i)-algebra ^i,Q((^,) 
associated with V: 

aooJum- V^Q, x^ PdoJiA^)- 

We let: 

(8.2.10) PDoJum:=ll(T-aDo,f,A^)) inQ(0)[r] 

xev 

be the minimal polynomial over Q(0) of aDo,fi,m- 
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Chapter Nine 



Applying Arakelov theory 

B. Edixhoven and R. de Jong 

In this chapter we start applying Arakelov theory in order to derive a 
bound for the height of the coefficients of the polynomials PDo,fi,m as 
in (8.2.10). We proceed in a few steps. The first step, taken in Section 9.1, is 
to relate the height of the bi{Qx,i) as in Section 8.2 to intersection numbers 
on Xi. The second step, taken in Section 9.2, is to get some control on the 
difference of the divisors Dq and Dx as in (3.4). Certain intersection num- 
bers concerning this difference are bounded in Theorem 9.2.5, in terms of a 
number of invariants in the Arakelov theory on modular curves Xi. These 
invariants will then be bounded in terms of I in Sections 11.1,11.2, and 11.3. 
Finally, in Section 11.7, the height of the coefficients of the PooJum will 
be bounded. In this chapter, we do our best to formulate the most important 
results. Theorem 9.1.3, Theorem 9.2.1, and Theorem 9.2.5 in the context of 
curves over number fields, i.e., outside the context of modular curves. 

9.1 RELATEVG HEIGHTS TO EVTERSECTION NUMBERS 

We pick up the notation as at the end of Section 8.2, so we have a mod- 
ular curve Xi = Xi{51)q with I > 5, non-constant morphisms 6; and 
x'l : Xi Pq, and certain divisors D^" = Yl'i=\ Qx,i on X^ q that have 
support outside the cusps. It is our objective in this subsection to link the ab- 
solute height h{bi{Qx^i)) of the algebraic numbers hi{Q,r.i) to certain quan- 
tities coming from Arakelov intersection theory. The height of x[{Qx,i) will 
be bounded in terms of h{bi{Qx,i)) in Section 11.5. The final estimates for 
these heights, depending only on I, will be done in Section 11.7. 
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9.1.1 Theorem Let x be in V, and let i be in {I, ... , d^}. Let K be a 
number field containing Q(C50 and such that Qx,i is defined over K. Let X 
be the minimal regular model of Xi over K. Then we have: 



h{h{Qx,i)) < 777-7^1 \ {Qx,i,bi oo)x + fy2^^P9<j 



iogi\bi\^ + l)fixA+^log2. 



Here a runs through the embeddings of K into C and is the Arakelov- 
Green function on Xi^^r- 

In the next chapters we shah derive bounds that are polynomial in I for all 
terms in the above estimate. 

Theorem 9.1.1 will be derived from Theorem 9.1.3 below, which states 
a fairly general result. We start with a definition. Let K he a number field 
and consider Pq^. Let 00 denote the O^-point (1 : 0) of Pq^- For any 
section P in Fq^(Ok) we define by (P, oo)pi the degree (see (4.3.1)) of 
P*Opi(oo), where Opi(oo) has the Fubini-Study metric, i.e. the metric 
II • 1 1 pi given by: 



(9.1.2) ||l||pi(xo :a;i) : '"^^ 



over Pj.. Here 1 is the tautological section of Opi (00). 



9.1.3 Theorem Let X be a geometrically irreducible, smooth and com- 
plete curve of positive genus over a number field K and let X be a proper 
semi-stable model of X over the ring of integers Ok of K. Suppose that 
we have a non-constant morphism f : X ^ F]^ and a K -rational point 
Q of X with f{Q) 7^ 00. Assume the following: the Zariski closure of 
Supp(div(/)+) U Supp(div(/)_) in X is Stale over Ok- For any closed 
point s ofSpec{OK), denote by ms{f) the supremum of the multipUcities 
of div(/)_ on X along the irreducible components of the fibre at s of X. 
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Then we have the ineqmhty: 



(/(Q),oo)pi < {Q, f*oo)x + deg f^sup g„ 

+ (1/2)^ / log{\ff + l)fix. +J2^s{f)log#k{s) . 

a •' s 

Here the first sum runs over the embeddings of K into C, and the last sum 
runs over the closed points ofSpec{OK)- 

Proof Note that the locus of indeterminacy of / on A' consists of finitely 
many closed points. This implies that there exists a blow-up X ^ X of X 
such that / extends to a regular map / : ^ — >■ P^^ . For any such X we 
have by construction: 

(/(Q),oo)pi = deg/(Q)*(Opi(oo), || • ||pi) 
= degg7*(Opi(oo),||-||pi) 

= degQ*(O;e(r^)'ll-llp0, 

where we write oo to emphasise that /*oo is the inverse image under / of 
oo{Spec{OK)), and not the Zariski closure /*oo of the inverse image under 
/ of oo{Spec{K)). If we let || • \\x denote the canonical Arakelov metric on 
Ox(/*oo) then we can write: 

degQ*(0;e(roo), II • ||pi) = deg Q*(0^(r oo), || • ||x 



• \\x 

= degQ*{0^{roo),\\-\\x) 

V II ■ 11^ 

= iQJ*o6)^+^log{{l^){Q,)). 



A bound for log((|| • ||x/|| • ||pi )(Qcr)) follows by testing on the tautological 
section 1, giving: 

log ||l||x(Qa) - log ||l||Fi(Qa) = 5^(7*00, Q^) + ^ log(|/(Q^)|2 + 1) . 
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Applying Proposition 9.1.4 below at this point shows that: 



9a{r^,Qa) + Uogi\f{Q.)\' + l) < (deg/)sup5a 




log(|/P + l)/xx<.. 



This accounts for the second and third terms in the bound of the theorem. 
We are finished once we prove that {Q, f*oo) ^ — {Q, f*oo)x is bounded 
by rnsif ) log #k{s) for a particular choice of X. (The usual projec- 
tion formula shows that in fact {Q, f*oo) ^ is independent of the choice 
of X.) On any X we write /*oo as a sum /*oo = (/*oo)hor + (/*oo)vert 
of a horizontal and a vertical part. Note that (/*oo)hor = f*oo, with 
the Zariski closure now taken in X. Since the local intersection mul- 
tiplicities of Q and /*oo do not go up when passing from X to X, 
we have (Q, (/*oo)hor);e = {QJ*'^)x < {QJ*^)x and thus we 
are reduced to proving that {Q, (/*oo)vcrt);t' bounded from above by 
X^s ^s{f ) log #k(s) for a particular choice of X. 

We exhibit a specific blow-up, and we calculate which multiplicities / ac- 
quires along the irreducible components of the vertical fibres of this blow- 
up. Note that the locus of indeterminacy of / on consists precisely of 
the closed points of X where an irreducible component C from the zero 
divisor div(/)+ of / on A" and an irreducible component C from its po- 
lar divisor div(/)_ meet. Now since by assumption the Zariski closure of 
Supp(div(/)+) U Supp(div(/)_) in X is etale over Ok, this can only hap- 
pen when at least one of C, C is vertical. In such points where this happens 
we have to perform a sequence of successive blowings-up until a compo- 
nent arises with multiplicity for /, so that the components with positive 
multiplicities and the components with negative multiplicities are separated 
from each other. 

We begin by observing that it will cause no harm if we pass to a finite 
extension K ^ K' . Indeed, both the left hand side and the right hand side 
of the inequality that we wish to prove get multiplied by [K' : K] if we do 
this. Here is why: for the terms (/(Q), oo)pi and {Q, /*oo) the scaling by 
a factor [K' : K] follows from general properties of the Arakelov intersec- 
tion product, cf. [Fall], p. 404 for example. (Note that it is understood that 
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over K' , intersection products are taken on the minimal resolution of the 
puUback of the model X.) That the term Yla ^^Vx^ 9cr scales by a factor 
[K' : K] is obvious. Finally, fix a closed point s of Spec(Oi^) and let s' 
be any closed point of Spec{OK') above it. Denoting by e^/ the ramifica- 
tion index of s' over s and by fg' the degree of the residue field extension 
of s' over s, we see that for any s' above s, the integer ms{f) gets multi- 
plied by Eg', and the number log#k{s) gets multiplied by f^/. Using that 
J2s' ^s'fs' = [K' : K], the sum running over the closed points s' above s, 
we see finally that also the term ^gms{f ) log #k{s) gets multiplied by 
[K' : K]. 

Starting with X over Ok, we first do the following. Let x be a closed 
point on X that is the intersection of a vertical component C and a horizon- 
tal component C having non-zero multiplicities m and m' for / that have 
different sign. After blowing up in x, we obtain an exceptional divisor E 
whose multiplicity for / is m + m'. We have two distinguished points on E, 
one lying on the strict transform of C, and one lying on the strict transform 
of C. At exactly one of them there is a sign change for the multiplicities, 
or m -I- m' = 0. If a sign change happens at the double point lying on the 
strict transform of C, then we repeat the process. If a sign change happens 
at the double point lying on the strict transform of C or if m -I- m' = 0, we 
stop, and continue with a new point x', if available. 

We end up with a blow-up X' ^ X such that an intersection of two ir- 
reducible components C, C that have different sign in div(/) on X' only 
occurs for C, C both vertical. For this, we did not yet need to extend the 
ground field K. In order to continue, we note the following. Suppose that 
we have a closed point x on the model X' of X over Ok which is a double 
point of a vertical fibre, and two irreducible components C, C of that verti- 
cal fibre pass through x, having non-zero multiplicities m and m' for / that 
differ in sign. Assume that K ^ K' is a Galois extension that ramifies over 
the image of x in Spcc(0/^), with a ramification index e that is a multiple 
of m — m'. In passing to the minimal resolution X of Xq ^, the point x 
gets replaced by a chain of e — 1 projective lines of self-intersection —2. 
The multiplicities of / along these components change in e steps from em 
to em', so that the steps are m — m' and a multipUcity will appear some- 
where, because m — m' is a divisor of em. 
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Thus we see how we can reach our goal: take a Galois extension K ^ K' 
that ramifies as specified above over the images in Spec(Oft:) of the double 
points where components meet with a different sign for /. (This is always 
possible.) By our remarks above, it suffices to prove the inequahty over K' . 
By construction, the morphism / extends over the model X that arises in this 
way. Moreover, it follows from the construction that for s' a closed point 
of Spec(0/^/) and .s its image in Spec(0;^) we have msi{f) < esims{f). 
Hence the sum of the local intersection numbers {Q, {f*oo)ycrt)s' for all s' 
over s is bounded from above by [K' : K]ms{f) log #k{s). This is what 
we needed to prove. □ 

9.1.4 Proposition Let f : X ^ be a finite morptiism of Riemann sur- 
faces with X connected and of positive genus. Consider on X — f~^oo the 
function: 

h{x) = gifocx) + ^log{\f{x)\^ + 1) . 

Then h extends uniquely to an element ofC°°{X), also denoted h. For all 
X e X we have: 

h{x)<{supg)degf + l [ log(|/p + l)/x^. 
X ^ Jx 

Proof Let us first show that h extends to a C°° function on X. In fact, as 

the beginning of the proof of Theorem 9.1.3 indicates, h is the logarithm of 

the function x ^ ||-||x(a;)/||-||pi(x) that gives the quotient of two metrics 

on Ox{f*oo): the Arakelov metric || ||x and the puUback of the Fubini- 

Study metric |H|pi (see9.1.2). Butthen /tisinC°°(X). We have, by (4.4.4): 

h{x) = I -g{x,y)^{ddh)y + [ h^x- 

JyeX TTZ Jx 

For s any local holomorphic generator of Ox{f*oo) we have: 

l^ddh = :^ddlog{\\sfx) - ^ddlog{\\s\\li) = (deg/)/xx - /Vpi , 

TTl iTTl ZTTI 

where //pi is the curvature form of the Fubini-Study metric on Opi{oo). 
Substituting this in the previous equality, and using that for all a; in X we 
li^ve Jy^j^ g{x, y)nx{y) = 0, we get: 

h{x)= [ g{x,y)irfip^)y+ [ i log(|/|2 + 1) ;xx ■ 
JyeX Jx ^ 
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As /ipi defined as the curvature form of the Fubini-Study metric on Opi (oo), 
we have Jpi //pi = deg(Opi(oo)) = 1. As the metric is invariant under 
the transitive action of SU2, fipi is everywhere positive. In fact, one can 
compute that /itpi = {i/2Tr) dz dz/ (1 + l-zp)^. We end up with: 

h{x)<{sn^g)degf + \f \og{\ f \^ + 1) 11 x 
X ^ Jx 

as required. □ 

Proof [Proof of Theorem 9.1.1] In order to simplify our notation, we drop 
the subscript I in bi. For P in F^{Ok) we put: 

h'iP) = {p,^)/[K -.q]. 

Then we have h{P) < h'{P) + (1/2) log 2, as for all x G we have 
+ |x2p < 2max{|xi|, 1x2!}^. In order to bound h'{b{Qx,i)) from 
above we want to apply Theorem 9.1.3. It follows from the definition of 
the morphism b that both the zero divisor div(6)_|- and the polar divisor 
div(6)_ of b on Xi have as their support only K-rational closed points, 
namely, cusps. In particular, we never have b{Qj; i) = 00, by construction 
of D'^. We have also seen that the Zariski closure in X of Supp(Cusps) is 
etale over Ok (as 0/^-valued points the cusps are disjoint), and hence the 
same holds for the Zariski closure in X of Supp(div(6)+)USupp(div(6)_). 
Theorem 9.1.3 now gives us that: 

[K : Q]-h'{b{Q^,i)) < {Q^,i,b* oo)x + degb^supga 

+ (1/2)^ / log(|6|2 + lVx.+^m3(6)log#A;(s) 

with ms{b) the supremum of the multiplicities of div(6)_ on X along the 
irreducible components of the fibres of at s. We are done if we can 

prove that dcg6 is at most and that ms{b) = for all s. The definition 
of b shows directly that its degree is I'^—l (it is the degree of the natural 
morphism from Xi{5l) to Xi(5)). Let us now show that ms{b) = for 
all s. For this we evidently need information on the divisor div(6) on X. 

We start with working over Q(C5i)- From the discussion in Section 8.1 
we recall that there is a fine moduli scheme Yi{5l)x[t^^i] over I^K^i] of el- 
liptic curves with balanced level structure (terminology from [Ka-Ma]). 
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Let E{51) — )■ Yi{5l)^(^,^^] be the universal elliptic curve and let P5, Pi be 
the tautological points of order 5 and I. From Proposition 8.2.8 we re- 
call the elhptic curve E Yi(5)' with ¥1(5)' = Spec(Z[6, l/discr(£;)]). 
The elliptic curve E{51) ^i(50z[C5i,i/5] arises from E ^i(5)' by 
a unique base change il(5Z)z[^g;^i/5] This gives the regular 

function b on yi(5Z)^[^_j 1/5]. As b is invertible on yi(5)' it is invert- 
ible on Yi{5l)^^^^^i/^]. We conclude that div(6) on Xi(5/)^[^,^j] is a cer- 
tain linear combination of the irreducible components of the closed sub- 
schemes Cusps and Xi{5l)f^^Q]. In order to find this linear combination, 
we examine the multiphcities of b along the irreducible components that we 
have isolated. 

We start with the multiplicities along the irreducible components of the 
divisor Cusps. It is sufficient to study the situation over C, and here we can 

make a beginning by looking at div(6) on Xi{5)c. From the equations in 
Proposition 8.2.8 we obtain that over the cusp of Xo(5)c lie two cusps, 
say ci and C2, with ci, say, corresponding to the 5-gon with the tautological 
point of order 5 being on a component adjacent to the connected component 
of 0, and the other, C2, corresponding to the 5-gon with the tautological 
point of order 5 being on a component that is not adjacent to the connected 
component of 0. We have div(6) = ib(ci — C2) on Xi(5)c; we could 
compute the exact sign but that is not important for us. The divisor of b on 
Xi{5l)c is obtained by pulling back its divisor on Xi{5)c via the forgetful 
map Xi{5l)c — Xi{5)c. Hence, pulling back the divisor ci — C2 we get 
plus or minus the divisor of b on Xi{5l)c; the multiplicities are just the 
ramification indices above the cusps ci and C2. Since these are in {1, /}, we 
obtain that the multiplicities of b along the irreducible components of Cusps 
are just 1 or Z in absolute value. 

Next we calculate the multiplicities of b along the irreducible compo- 
nents of Xi (5/)]f g [Q]. The structure of a connected component of the scheme 
Xi(5l)f^^[Q] is as follows: it consists of two irreducible components, one on 
which P5 has order 1, and one having an open part where P5 has order 5. 
These two irreducible components intersect (transversally) in the supersin- 
gular points. 

We denote by T the union of the irreducible components over F5 on which 
P5 has order 1. The construction of the scheme 11(5)' immediately gives 
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US a forgetful map Xi(5Z)2[^,^j] — T — Supp(Cusps) — > 11(5)'. Since b is 
invertible on Yi(5)', the same holds for b along the irreducible components 
of Xi (51) [Qj, except possibly for the irreducible components in F. But the 
multiplicity of b along such an irreducible component is then also zero, as 
can be seen by the following argument. Let C U C" be a connected com- 
ponent of Xi{5l)f^[Q], with the irreducible component C corresponding to 
P5 having order 1. All the horizontal components of div(6) on Xi(5Z)2[^gj] 
specialise to C. We know that b has multiplicity along C and hence it 
restricts to a non-trivial rational function, also denoted b, on C. The degree 
of b on C' is zero, or equivalently m{C', C) + (C, div(6)hor) = 0, where 
m is the multiplicity of b along C. Now, since (C",div(6)hor) is zero and 
(C, C) isn't, we get m = 0. 

All in all we conclude that the absolute values of the multiphcities of the 
irreducible components in div(6) on Xi(5Z)2[^gj] are bounded by a constant 
times /, and that all multiplicities along irreducible components of fibers 
over closed points s of Spcc(Z[C5;]) are zero. In particular, for all closed 
points s we have ms{b) = 0. This implies in fact that the rational function 
b on Xi(5Z)z[^5;] extends to a morphism to P^. As this is a useful fact, we 
record it in a Proposition. This completes the proof of Theorem 9.1.1. □ 

9.1.5 Proposition Let Z > 5 be prime a prime number. The rational func- 
tion bi on Xi(5Z)z[^gj] from Proposition 8.2.9 extends to a morphism to Pg. 

9.2 CONTROLLING - Do 

In this subsection, the hypotheses are as follows (unless stated otherwise). 
We let K he a number field. Ok its ring of integers, B := Spec(Oii-), 
p: X B a regular, split semi-stable curve over B whose generic fi- 
bre X SpecK is geometrically irreducible and of genus g > I. We let 
D be the closure in X of an effective divisor of degree g (also denoted D) 
on X. We let a; be a K-rational torsion point of the Jacobian of X, i.e., a 
torsion element of Pic{X), which has the property that there is a unique ef- 
fective divisor on X such that x = [D^ — D] . Finally, we let P : B ^ X 
be a section of p, i.e., an element of X{B). 

We denote by ^x,p the unique finite vertical fractional divisor $ (i.e.. 
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with rational coefficients that are not necessarily integral) on X such that 
— D — ^,C) = for all irreducible components C of fibres of p, and 
such that P{B) is disjoint from the support of It is not difficult to see 
that a $ satisfying the first condition exists and that it is unique up to adding 
multiples of fibers of p (the intersection pairing restricted to the divisors with 
support in a fibre is negative semi-definite); see Lemme 6.14.1 of [Mor2]. 
The second condition removes the ambiguity of adding multiples of fibres. 

We denote by dg the number of singular points in the geometric fibre at a 
closed point s of B. 

9.2.1 Theorem The OB-module R^p*Ox{Dx) is a torsion module on B, 
and we have: 

{D^,P) + log #R^p,OxiD^) + ^icox/ b,<^x/b) + ^ ^ 5. log#A;(s) 

s 

= {D,P) -^{D + $^,p, D + $^,p -ujx/b) + ^ deg det p^u^/B 
+ Y,I log|K||(DJ-g)-Ma(g) + |[i^:Q]log(27r). 

Here s runs over the closed points of B, and a runs through the complex 
embeddings of K. 

We derive Theorem 9.2.1 from three lemmas. For the moment we work 

in Q (8)z Vic{X). 

9.2.2 Lemma The admissible line bundles: 

Ox{D^-D)®p*P*Ox{D^-Dy and Ox{^x,p) 

are numerically equivalent. That is, for any admissible line bundle F onX 
we have: 

{Ox{D^-D)®p*P*Ox{D,-DY,F) = {Ox{^.,p),F). 

Proof In this proof we just write <I> for ^x,p- We denote the first line bun- 
dle in the lemma by ^. Since Dx — D is, torsion, there is a positive integer 
N such that is trivial on the generic fibre as a classical line bundle 
(that is, without taking the metrics into account). We have a canonical iso- 
morphism P*^ Ob on B. Combining, we find that has a rational 
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section s with dwx{s) vertical and with P*s i— > 1. The latter condition 
implies that P intersects to zero with div;f (s) for the Arakelov intersection 
product. On the other hand, as p*P*Ox{Dx — Dy is trivial on the fibres 
of p over finite places of B, we have {N{Dx — D) — divA'(s), C) = for 
all irreducible components C of fibres of p. Hence in fact $ = jjd.\Yx{s). 
To prove the lemma, it suffices now to prove that ^!®^ Ox(dwx{s)) 
given by s I— )■ 1, with 1 the tautological section, is an isometry. Because 
of admissibility, it suffices to check that this is so when restricted to P; but 
here we get the canonical isomorphism P*^' Ob- This is indeed an 
isometry by the definition of □ 

9.2.3 Lemma Let X be a compact Riemann surface of genus g > 1. 
Let D be an effective divisor on X of degree g satisfying h^{D) = 1. 
Then the determinant of cohomology X{Ox{D)) of D is identified with 
H^{X,Ox{D)). Further, the formula: 

log ||1|| + ^ + ^ log \\n{D - Q) ■ f,x{Q) = 

holds for the length (with respect to Faltings' metrisation of the determinant 
of cohomology) of the tautological section 1 of H^{X, Ox (D))- 

Proof Since h°{D) = 1, H^{X,Ox{D)) = C. Therefore, the set of 
points Q on X such that h^{D — Q) > is the support of D. Let Q be 
a point outside the support of D. Then h^{D — Q) = 0. According to 
the axioms for the metrisation of the determinant of cohomology, the exact 
sequence: 

-> Ox{D -Q)^ Ox{D) ^ Q^Q*Ox{D) ^ 
gives rise to an isometry: 

X{Ox{D)) X{Ox{D - Q)) ® Q*Ox{D) ^ 

= 0{-Q)[Ox{D - Q)] ® Q*Ox{D). 

Taking the norm on left and right of a tautological section we obtain, us- 
ing (4.4.6): 

||1|| = exp(-<5(X)/8) • \\n{D - Q)-i • G{D, Q), 
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where logG{D,Q) = go^nxiQ)- Taking logarithms and then integrating 
against nxiQ) gives the result. □ 

9.2.4 Lemma (Noether fonnula) We have: 

12 degdet p*ux/B = {^x/b,^x/b) + '^Sslog#k{s) 

s 

+ J2^iX'r)-MK -Q] log(27r), 

(7 

the first sum running over the closed points of B, the second sum running 
over the complex embeddings of K. 

Proof See [Fall] and [Mor3]. □ 

Proof [Proof of Theorem 9.2.1] We first show that R^p^Ox{D^) is a tor- 
sion module. As it is a coherent Oe-module, it suffices to show that it is zero 
on the generic point of B, i.e., that H^(X, Ox{Dx)) is zero. By Riemann- 

Roch, we have h^{Dx) — h}{D.j.) = 1. By definition of Dx, we have 
Ox{Dx) — Cx{D). And by construction of D, we have hP{Cx{D)) = 1. 
This shows that h^iDx) = 0. 

Let us now prove the identity in Theorem 9.2.1. We start by noting that, 
by (4.4.7): 

(Dx -D,P) = degP*Ox{Dx - D). 

By Lemma 9.2.2, Ox{D:,) ® p*P*Ox{Dx - and Ox{D + $^,p) are 
numerically equivalent. The Riemann-Roch theorem then gives: 

degdetRp40xiDx)^p*P*0xiDx - D^) = 

= ^{D + ^x^p,D + $j;,p - ujx/b) + degdetp^ujx/B ■ 

By the projection formula for the determinant of cohomology we can write 
the left-hand side as: 



degdetRp,{Ox{Dx)^P*P*Ox{Dx - 0^) = 

= degdelRp^Ox{Dx) - deg P*Ox{Dx - D) 
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Since p*Ox{Dx) is canonically trivialised by the function 1, the term 

deg det Rp^Ox{Dx) can be computed as: 

degdetRp^Ox{D^) = -^log - log#R^p^Ox{D^), 

where for each complex embedding a, the norm is the length of the 
tautological section 1 of A(Ox<,(-Dx)) = H^{Ox^{Dx)). By Lemma 9.2.3 
we can then write: 

degdetRp,Ox{D:,) =Y, [ log - Q) • 

+ ^ d{Xa)/8 - log #R^p,Ox{D^) . 

a 

Combining everything gives: 

1 

2 

+^[ logmm-Q)■^,AQ) 

+ - log #rVo^(^.) ■ 

a 

We obtain the required formula upon eliminating '^^5{Xcr)/8 with the 
Noether formula, Lemma 9.2.4. □ 

9.2.5 Theorem We have an upper bound: 

{D^,P) +\og#R^p,Ox{D^) < - ^{D,D-ujx/b) 

+ 2g^Y.dslog#k{s) 
seB 

+ ^log||^||,,sup + |[i^:Q]log(27r) 

a 

+ ^ deg det p^ux/B + iD,P), 

where s runs through the closed points of B, and where the supnorm 
\ma,sup is taken over Fic<^-\X^). 

The required upper bound follows directly from Theorem 9.2.1 by using 
Lemma 9.2.6 below and the fact that {(^x/Bi^x/b) > (cf- Thm. 5 
of [Fall]). 
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9.2.6 Lemma We have an upper bound: 

-^{D + $^,p, D + $^,p - ljx/b) < 
with s ruDiuDg through the closed points of B. 

Proof In this proof we just write $ for *^x,p- By the definition of we 
have {Dx — D — $) = 0, or in other words, $) = {D^ — D, $). 
Using this we can write: 

-^{D+^,D + ^-cox/b) = -^{D,D-cox/b) + \{^,^^x/b-D-Dx) ■ 

We write $ = ^{C) ■ C, and for any finite fibre Fg of p we put 
:= supc I^IC')! with C running through the irreducible components 
of Fs. Since lu;^ D and intersect any irreducible component C with 
non-negative multiplicity, we find 

^{^,ujx/b-D-Dx) < ^ ^AsFs,ujx/B + D + Dx 
< 2gYAs\og#k{s). 

s 

We are going to prove that As < g5s, and then we are done. So let s be a fi- 
nite place of B. Let be the set of irreducible components of Fs, and let Si 
be the set of double points on Fg. Let Fg be the dual graph of Fs (thus, the 
set of vertices of Tg corresponds to So, the set of edges corresponds to ^i, 
and the graph is defined by the incidence relations). Choose an orientation 
on Tg. This gives rise to the usual source and target maps s and t: Si ^ Sq. 
Consider the boundary and coboundary maps = — : Q^'^ — )■ 
and d* = t* - s* : Q^o Then d^.d* : Q^o _^ qSo given by 

minus the intersection matrix of Fg. In particular, the map sends <^> to 
the map u: C ^ — ($,C) = {D — Dx,C). The kernel of d^d* consists 
exactly of the constant functions, and the image consists of the orthogonal 
complement of the constant functions. Now consider the graph Fg as an 
electric circuit, where each edge has a resistance of 1 Ohm. By Ohm's law 
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and by spelling out the maps and d* we see that if we let at each ver- 
tex C a current of u{C) Ampere enter the circuit, subject to the condition 
that u{C) = 0, the potentials ip{C) at each vertex C will be given, up 
to addition of a constant function, by a solution of the equation d*d*ip = u. 
Hence $ is the potential corresponding to the current C i-> [D — D^, C), 
normalised by the condition that $(Cp) = with Cp the component that 
P specialises to. We must bound the |$(C)| for C varying over Sq. The 
worst case that may happen is that Tg is a chain, with D' and D specialis- 
ing entirely to the beginning and end point, respectively. In this case, the 
biggest potential difference is 5 • (#5o — 1) in absolute value, so that we 
arrive at |^*(C)| < g ■ {#So — 1). Now note that Tg is connected and that 
X/ K has split semi-stable reduction. This gives jj^So — 1 < 5s and hence 
[^(C*)! < g5s, as required. □ 
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Chapter Ten 



An upper bound for Green functions on Riemann 
surfaces 



We begin with explaining the setup and the results of this subsection. Let 
X be a compact Riemann surface, endowed with a 2-form /i > that fulfils 
fj^lJ. = 1. Let * denote rotation by 90° in the cotangential spaces (with 
respect to the holomorphic structure); in a coordinate z = x + iy this means 
*dx = dy, *dy = —dx and, equivalently, *dz = —idz, *dz = idz. In 
particular, the Laplace operator on real C°° functions on X can be written 
as d*d = 2idd. 

For a, 6 G X, let ga^h '■ X — {a, 6} — M be the (unique) solution on X (in 
the sense of distributions) of the following differential equation: 



Note that ga,a = 0. The distributional differential equation for g^^^ is equiv- 
alent to the following two more elementary conditions. Firstly, 5 is a 

real-valued harmonic function on X — {a, 6}. Secondly, it has logarithmic 
singularities near a and near b of the following type: for any local coordinate 
z near a, the function P ga,b{P) — (27r)^^ log \z{P) ~ z{a)\ extends to 
a harmonic function in a neighbourhood of a, and for any local coordinate 
w near b, the function P i-> ga,b{P) + (2vr)~^ log \w{P) — w{b) \ extends to 
a harmonic function in a neighbourhood of b. The existence of such a func- 
tion gafi is shown in the theorem in paragraph n.4.3 on page 49 in [Fa-Kr]. 



F. Merkl 



d*dga,b = Sa- Sb onX 



with the normalising condition: 
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However, for a close to b, the proof of Lemma 10.4 below also shows the 
existence of ga,b as a by-product. The difference of any two solutions of the 
differential equation for ga^b extends to a global harmonic function on X 
and thus is a constant. Hence, the normahsing condition for ga^j, determines 
the function 5 uniquely. 
Now, for X e X — {a}, let 



gaA^) ■= / 9a,b{x) IJ:{b). 

Jbex-{x} 

Then we have: 

d*dga,n{x) = da- n 
in the sense of distributions, and: 

ga,ix = 0. 

IX-{a} 

We consider an atlas of X consisting of n local coordinates: 

^U) , jjU) ^ c, j = l,...,n, 

such that each range z^^ [U^^^] contains the closed unit disk. For any radius 
< r < 1 and j G {1, . . . , n}, we define the disk: 

= {p e t/O) I 1^0) (P) I <r}. 

We fix a radius < ri < 1 once and for all. Our aim is to prove the 
following result. 

10.1 Theorem Assume that the open sets U^P^ with j in {l,...,n} 
cover X. Next, assume that c\ is a positive real number such that for all 
j in {1, . . . ,n} we have: 

fi<ci\dz^^^ Adz^^^\ onUi'\ 

Finally, assume that for all j and k in {1, . . . ,n}: 



sup 



dz^^) 



< M 
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holds with some constant M > 1. Then for some positive constants cy, cg, 
cio and cn, depending only on ri, we have, for all a in X: 

log 2 



(10.2) 



9a,iJ. < nicio + cicii + C7 log M) + 



27r 



and, for all j such that a G Url : 



(10.3) 



lim 



9a A^) 



1 
2^ 



< 



, , log M 

< n(Cio + CiCii + C7 log M) + — h eg. 

zvr 



We start by considering just one coordinate z = z^j^ for a fixed j. To sim- 
plify the notation in this section, we drop the superscript (j) in U = U^^\ 
z = z^^\ and so on. We fix three radii < ri < r2 < ra < 1 once and for 
all. The radii r2 and r3 should depend only on ri; e.g. r2 = (2ri + l)/3, 
f3 = (ri + 2)/3 is an admissible choice. Furthermore, we fix a partition of 
unity: let % : X ^ [0, 1] be a C°° function which is compactly supported in 
the interior of Ui with x = 1 on Ur^ , and set = 1 — x- More specifically, 
we take x = x(kl) on Ui with a smooth function x: — [0, 1] such that 
x{r) = for r > 1 — e with some e > 0, and x{r) = 1 for r < r2. The 
shape function x may be taken independently of X and the choice of the 
coordinate z, only depending on r2. 

We shall use the 2-norm of a (real valued) 1-form cj over a measurable 
set y C X defined by: 

where oj = oji^ + a;o,i is the decomposition of lj in its components in 
T(i o)-'^ and r(o,i)X. In the case Y = X, we just write ||a;|| for ||a;||x- 

Given a and b in Ur^ , we define the following function, having logarith- 
mic singularities in a and b: 



fa,, := ^ log 



(z — z{a)){z{a)z — 1) 



{z-zmz{b)z-i) 



on Ui — {a, b}. 



Note that the singularities at l/z{a) and l/z{b) do not lie within the unit 
disk. We note that: 



d*dfa,b = Sa-6b 
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holds on Ui in the sense of distributions, and that 5 fulfils Neumann 
boundary conditions on dUi . One can see this as follows. The meromorphic 
function on Ui given by: 

p {z{P)-z{a))(^z{P) - 1) _ i4P)-zia))ij(P)-zia)) 

^ iz{p) - zmWMP) - 1) ~ {z{p)-z{h)){^^-w)) 

takes positive real values on dU\. Let Log denote the principal branch of 
the logarithm. The function 



(m 1 ^_(^(P)-z(a))(z(a)z(P)-l) 
QaAP) — 7i- Log ■ 



27r {z{P)-z{b)){z{h)z{P)-l) 

is defined and holomorphic for P in a neighbourhood of dUi , and it takes 
real values for P G dUi. As a consequence, the directional derivative of the 
imaginary part 9ga,6 tangential to dU\ vanishes on dUi. Using holomorphy, 
this impUes that the directional derivative of the real part 3?ga,6 in normal 
direction to dU\ vanishes also on dUi. Using ^qa,b{P) = fa,b{P) for 
P in a neighbourhood of Ui, this proves the claimed Neumann boundary 
conditions for fa^b- 

Finally, for a G C/n and P G J7i — {a}, we set: 

la{P) := ^x{Pnog\z{P) - z{a)\, 

extended by to X — {a}. 

Our first step in the proof of Theorem 10.1 is the following key lemma. 



10.4 Lemma For a and b in 1/^, the supremum supx \9a,b — la + h\ is 
bounded by a constant 02 = 04 + C1C5, with 04, C5 depending only on ri. 

10.5 Remark Note that ga,b ^hi + h has removable singularities at a and b, 
since the logarithmic singularities cancel. The constant C2 is uniform in the 
choice of the Riemann surface X, and uniform in the choice of a, 6 G ?7,.^. 
The choice of the coordinate z influences C2 only via the dependence of ci 
on the choice of z. The radii r2, rs and the shape function % are viewed as 
ri -dependent parameters; this is why we need not emphasise in the lemma 
that C2 also depends on these quantities. 
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Proof (of Lemma 10.4) We define the 2-form: 

Ua,b ■■= d*d{x''fa,b) onUi-Wi 

and extend it by to the whole surface X. Note that 5 is supported in 
C/i — Ur2, since x'^ varies only there, and since fa^b is harmonic. Consider 
the following variational principle on square integrable 1 -forms cj. We want 
to minimise ||a;p with the constraint: 

d*UJ = Ua,b 

in the sense of distributions. Writing the constraint with test functions, we 
see that the minimisation problem is taken over the following closed affine 
Unear subspace of L?{X, T*X): 

V = {ueL^{X,T*X): - [ dgA*uj= [ gua,b for all g e (X)} . 

Jx Jx 

The space V is nonempty, since 0Ja,b G V holds for the following 1-form: 



^a,b - 

Indeed, using Stokes' theorem, we have: 



d{x''fa,b) on Ui - Ur^, 
otherwise. 



- I dgh *Cba,b = - / dgh *Ua,b 
Jx JUi 

= - g*OJa,b + / gd*UJa,b- 

JdUi JUi 

The first summand in the last expression vanishes by the Neumann boundary 
conditions of x'^fa,b = fa,b on dUi, and the second summand equals: 



g d*Ua,b = / 9Ua,b 

Ui Jx 

by the definition of Ua,b- 

Our minimisation problem has a unique solution C0a,b € V. It fulfils: 

(10.6) / LOa,b A cr = for all closed C°° 1-forms a. 

Jx 
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Indeed: if da = 0, then uja,h + t*a holds for all t G M, since uja,b £ ^ 
and d*{*a) = —da = 0. Thus: 



d .. , ,.o 



= -2 / i^a,h A cr. 
=0 •''^ 



In particular: 

Wa,6 Adg = 



L 



X 

for all 5" G C°°{X), i.e. ciwa,^ = in the sense of distributions. Since 
d*uJa,b = Ua^b and cicja,?) = 0, we get that is smooth. This follows from 
(hypo-)elliptic regularity, as treated in Corollary 4.1.2 on page 101 in [Hor]. 
Precisely speaking, this corollary treats only the case of a single partial dif- 
ferential equation. However, as is mentioned at the end of Section 4.0 on 
page 97 of the reference, the extension of the result to systems of partial 
differential equations with as many equations as unknowns, as needed here, 
follows trivially. Then equation (10.6) imphes that uja,b is exact: 

^a,b = dga,b 

for some ga,b G C°°(X); see for example [For], Corollary 19.13. We nor- 
mahse ga,b such that: 

(10.7) / ga,bl^ = 0, 

Jx 

to make it uniquely determined. 
We set 



ha,b ■— ga,b + Xfa,b " / Xfa,blJ'- 

Jx 



We are now going to prove that d*dhafi = Sa — Si,. We claim that 
d*d{xfa,b) = —Ua,b + — Sf, holds. We prove this equality sep- 
arately on the three sets X — Suppx, X — Suppx'^, and Ui — Ur^, 
which cover X. The claimed equality holds on X — Suppx, because 
both sides vanish there. It holds also on X — Suppx'^, because there 
Ua,b = and d*d{xfa,b) = d*dfa,b = 5a - h are vahd. Fi- 
nally, on U\ — Uri, the function /„;, is harmonic, which implies that 
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d*d{xfa,b) = —d*d{x'^fa,b) = —Ua,b on this annulus, which neither con- 
tains a nor b. Thus the claim d*d{xfa,b) = —Ua,b + — h holds in all 
cases. 

Combining this with the fact d*dgafi = Ua^, we conclude 

d*dha,b = d*dga,b + d*d{xfa,b) = Ua,b - Ua,b + Sa-Sb 

and thus 

d*dha,b = 5a- 5b- 

Furthermore, using the normalisation /j. = 1 and QafilJ- = 0, we 
observe 



K,biJ- = 0. 

Because is uniquely characterised by its properties d*dga,b = 5a — Sb 
and Jj^ ga,blJ' = 0' we conclude ga^b = ha,b- Thus, we have shown 



The function: 



9a,b = 9a,b + Xfa,b ~ / Xfa,bl^- 

Jx 



(1) ~ , ^ 
9a,b = 9a,b + XJa,b 



is harmonic on X — {a, b}, and: 

(2) _ ~ _ Cf 
9a,b ~ 9a,b X Ja,b 

is harmonic on Ui; in particular both functions are harmonic on the annulus 
A ■.= Ui — . Now for every harmonic function g on A, we have a bound: 

maxg-mmg<C3\\dg\\A 

aUr^ OUr^ 

with some positive constant C3 depending only on r2 and r^; note that the 
circle dUr^ is relatively compact in the annulus A. We bound \\dg)^ 1\\a from 
above: 

\\dg^al\\A<\\d~ga,b\\A+\\d{x''fa,b)\\A. 



bookarxiv March 23, 2010 



220 CHAPTER 10 

We estimate the first summand as follows, using that uia,b = d9a,b solves the 
above variational problem: 

IMffo.blU < \\d9a,b\\ = \\^a,b\\ < \\^a,b\\ = \\^a,b\\A = M(x''/a,6) IU; 

we used that uja^i, is supported in A. Thus we have: 

||d5Sll<2|M(x7a,;.)IU, 

which is bounded by a constant, uniformly in a and b in Ur-^ . 

This also allows us to estimate g^l : on A, we know g^l = gfl + /a,6, 
hence, 

IM^SlU < IM^SlU + WdfaAA < 2M(x7a,6)IU + \\dfa,b\\A. 

Both summands on the right hand side are bounded by constants, only de- 
pending on ri and r2, but uniformly in a and b in C/n. To summarise, we 
have shown that: 

max q[^l — min q[^l 

(J = 1, 2) are uniformly bounded by a constant depending only on ri, r2, 
and rs. However, g^l is harmonic on X — Ur^, and g^l is harmonic on Urg, 
which both have the same boundary dUr^ . Thus, by the maximum principle: 

(1) ■ (1) (1) ■ (1) 

max q„ i — mm q„i, = max q„ I — mm q„ 1 



and: 



(2) . (2) (2) . (2) 

max q i — mm q i = max q i — mm q 1 . 

Furthermore, maxx-c/^g Ix/a.fel max^ |x'^/a,&| are bounded, uni- 
formly in a and b in Ur^, by a constant only depending on n and rs. Using 
9a,b = 9al-xfa,b on X-Ur^ and ga,b = ga),+x''fa,b on Urs, we conclude 
that maxx ga,b — minx 9a,b is bounded onX = {X — Ur^) U Ur^ by a con- 
stant cg only depending on the radii ri, r2 and rs. Using the normalisation 
condition (10.7), we know that: 



max5a,6 > > min^a^b 
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holds; thus: 

max \ga,b\ < T^^9a,b - T^^^9a,b 

is also bounded by the same constant. 
From this we get a bound for: 



221 



50,6 Xfa,b 9a,b I Xfa,bf^- 

Jx 



Indeed, we estimate: 

/ X/a,bM < / |/a,6|/^<Ci / \fa,bdz Adz\, 
Jx JUi JUi 

which is uniformly bounded for a,b €^ Ur-^ by a constant cic^ with C5 de- 
pending only on ri, note that the logarithmic singularities are integrable. 
Combining the bounds for maxx \ga,b\ and x/a,by^|' we conclude that 
supx \9a,b — xfa,b\ is bounded by a constant cq + C1C5 with cq, 05 depending 
on n. Since: 



sup \xfa,b -la + k\ = TT^^P 
X ^TT Ui 



Xlog 



z{a)z — 1 



z{b)z - 1 



is bounded, uniformly in a, 5 G 11^ and X, the key lemma follows (with C4 
being the sum of cq and the uniform upper bound last mentioned). □ 

Proof (of Theorem 10.1) Since we now work with varying coordinates, we 
include again the superscript coordinate index {j) in the coordinate z^^\ its 
domain U^^\ but also in U^^\ x^^K and l^^K 



10.8 Lemma Consider two coordinates z^^ and z^^\ with k and j in 
{l,...,n} 

\z^){y) - z^\x)\ < (r2 - ri)/M. Then y is in U, 



Assume that x is in Uj^i^ n u!^'^^ and that y is in uj^i^ with 



'r2 • 



(i) (k) 

Proof The intersection Url n ?7r\ is an open neighbourhood of x. As- 
sume that there exists y G u'f^ with \z^^\y) — z^^\x)\ < ( 



r2 - ri)/M 

and y ^ ■ Then there is also such a point y with minimal distance 
\z^^\y) — z^^\x)\ from x, since U^^ — Ur^ is compact. For this point y, 
we conclude y G dUr2 C Uj.^ , and the straight line from x to y in the 
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z^-^^ -coordinate is contained in C/^^ ^ • mean value theorem, 

we conclude — z^''\x)\ < M\z^j\y) — z^^\x)\ < r2 — ri, hence 

\^'"^Hy)\ < 1^2, since \z'^''\x)\ < ri. This contradicts y e OUr^^ . □ 

We choose a smooth partition of unity (j)'^^'^ : X — )• [0, 1], j = 1, . . . , n, such 
that (p'^^^ is supported in Ur{\ For a G X, we set: 

ha :=^</>(^)(a)Zi^). 



10.9 Lemma Let a eUr^ ,y E X,y a. Then we have: 



log 2 
27r ■ 



ik) 

a ! 



Proof This follows immediately from the definition of the function I 
since {z^'^Xy) — z^''\a)\ < 2 whenever?/ G Supp(x'''^^)- D 

10.10 Lemma For all a,b e X we have the inequality: 

sup \ga,b -ha + hb\ < n{ciQ + C1C5 + C7 log M) 

with constants cio, C5, and C7 depending only on ri. 

Proof We first show for a G C/^^f ^ n [7^^^^ that: 

sup - Zi^)| < ;^[logM + I log(r2 - ri)| + log2]. 

To prove this, let y e X. We distinguish 3 cases in order to prove that 
la^'' (y) — la^ {y) is bounded from above by the right hand side. 

case 1: 

y G U^^ with \z^^\y) — z''^\a)\ < (r2 — ri)/M. In particular, we 
have \z'^^\y)\ < \z'^^Ha)\ + (r-2 - ri)/M < r2 (recaU that M > 1), 
hence a,y & Uri'' . Consequently, the straight line [a,y]^^^ from a to y 
in the -coordinate is contained in Uri\ Then Lemma 10.8 implies that 
[a, y]^^^ C Ur^''. Using x^''\y) = X^'^Hy) = we conclude by the mean 
value theorem that: 



i^J'\y)-i^j\y) = ^^og 



z(j){y)-z(J}{a) 
which is bounded by the right hand side. 



logM 
- 27r ' 
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case 2: 

y ^ Then la\y) = 0, and we conclude, using Lemma 10.9, that: 
case 3: 

y e U[^^ and \z^\y) - z^\a)\ > (rs - ri)/M; thus: 

lf\y)-l^^\y) < ^^-l^^\y) < ^{log2-x^^\y)log[{r2-n)/M]), 

which is also bounded by the right hand side. 

The upper bound for in our claim is obtained by exchang- 
ing j and k. Thus the claim is proven. 

We conclude: 

(10.11) *^ 

1 

< — (logM + |log(r2-ri)|+log2). 

(i) 

Combining this with Lemma 10.4, we conclude for a,b E Url . 

\9a,b -ha + h\ < \ga,l, " 1^^^ + l?\ + K " ^'''^l + Ih " 

< cio + C1C5 + C7 log M 

with some constants cio ,05,07 depending only on ri (a possible choice is 
C7 = (logM)/7rand cio = (| log(r2 - ri)| + log 2)/7r + C4). 

Finally, for general a,b G X, we choose a finite sequence of points 
a = ao,ai, . . . ,am = 6 in X and indices ji, . . . , jm with m < n and 
ai-i,ai G t/rf'^ for alH = 1, . . . , m. Using: 

m 

9a,b ~ ^ ^^ 9ai-i,aii 
1=1 

we get by estimating: 

m 

\ga,b -K + hb\<^ \9ai-i,ai " Ki-i + hai\ < ?^(ciO + C1C5 + C7 log M) 
i=l 

the claim of the lemma. □ 
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We define: 

h^{x) := / hbix)n{b), {x G X). 
Jbex 

10.12 Lemma We have: 

sup I /i^ I < ncics, 

X 

with some universal constant cs- Furthermore, we have: 

sup hb[x) < ——. 
b,xex ^TT 

Proof We observe first that for aU w G C with \w\ < 1 the integral: 
— / I log 1^ — iy|| |dz A ciz| 

271" J\z\<l 

is bounded from above by a universal constant cg. We conclude that for all 
X e X v/e have: 

/ ^ \ll'\x)\ct>^^\b)tx{b)<cJ \ll^\x)\\dz^^^Ach(j)\ 
Jbeui-l' Jbeu!^\> 

Let X e X. We get the first estimate: 

Finally, the second estimate follows from Lemma 10.9: 

as required. □ 



10.13 Proposition For some positive constants cio, cy, and cn that depend 
only on r\ we have, uniformly in a and x ^ a onX: 

\9aA^) - ha{x)\ < n(cio + CiCii + cylogM). 
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Proof Indeed, averaging Lemma 10. 10 over b with respect to ji, we obtain: 
sup \ga,^l -ha + < n(cio + C1C5 + C7 log M). 

X 

By Lemma 10.12, one has < ncicg. Combining gives what we want 
(we can take cn = 05 + cg). □ 

10.14 Proposition Let cio, C7, and cn be as in Proposition 10.13, and let a 
beinX. Then lim.x-^a \9a,tJ,ix) — ha{x)\ exists, and we have: 

lim \9aA^) ~ ha{x)\ < n(cio + ciCn + cylogM). 

Proof The functions ga^^ and ha have the same logarithmic singularity 
at a; hence the limit exists. The estimate then follows from Proposi- 
tion 10.13. □ 

We can now finish the proof of Theorem 10.1. We have seen in (10.1 1) that: 

\ha - 4'^ I < 7^ (log M + I log(r2 - ri)| + log 2) . 

(i) 

Combining this with Proposition 10.14 and using the definition of la gives 
the second estimate of the theorem. As to the first estimate, using: 

ga,ti <ha + \ga,p. - 

we obtain it by applying the upper bound for ha in Lemma 10.12 and the 
upper bound for \ga,i_i — ha\ in Proposition 10.13. This ends the proof of 
Theorem 10.1. □ 
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Chapter Eleven 



Bounds for Arakelov invariants of modular curves 



B. Edixhoven and R. de Jong 

In this chapter, we give bounds for all quantities on the right hand side 
in the inequality in Theorems 9.1.1 and 9.2.5, in the context of the modular 
curves Xi (5/) with / > 5 prime, using the upper bounds for Green functions 
from the previous chapter. The final estimates are given in the last section. 

11.1 BOUNDING THE HEIGHT OF 

As before, for Z > 5 prime, we let Xi be the modular curve Xi{5l), over a 
suitable base that will be clear from the notation. We let gi denote the genus 
of Xi; we have gi > 1. A model Xi^z is given by [Ka-Ma], as well as a 
model -'^/^^[Cs;] ^^at is semi-stable; see Chapter 8. The aim of this section is 
to prove a suitable bound for the stable Faltings height of Xi (see 4.4.10). 
We will in fact give such a bound for the modular curves Xi {pi) with p and 
I distinct primes. Before we get to that, we prove some intermediate results, 
that will also be important in the next section. 

11.1.1 Lemma Let N > 1 be an integer, and let: 

MN):=l[ U S^,M,<i52(ri(M))-- 

M\Nd\{N/M) 

be the basis of S2{ri{N)) obtained from newforms of levels dividing N as 
explained in (2.2.17). Let f = X^„>i an{f)q"' be an element of B2{N). 
Then we have for alln> 1: 

\an{f)\ < 2n. 
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Proof As an{B*^ ^f) = an/dif) (see 2.2. 16), it suffices to treat the case 
that / is a newform of some level M dividing N. We use the Weil bounds 
on the ap{f) for all primes p. We recall from Section 1.8 of [De-Se] that we 
have an equahty of formal Dirichlet series: 

E = 11(1 - a,{f)p-T' 11(1 - a,p-T\l - Ppp-T' 

n>l p\M p\M 

with the following properties. Forp | M we have \ap\ = |/3p| = ^Jp. For 
p\M we have: 

ap(/) = ifp2|M, 

ap(/) = lief factors through (Z/(M/p)Z)'' , 

Op(/)| = pV2 if £^ does not factor through {Z/{M/p)'LY, 

ap(/)| = 1 if p2|M and £/ factors through {'L/{M/p)'L)'' . 

Using that: 

(l-ap(/)p-)-l = 5]a^(/)V^^ 

ifc>0 

and that: 



(1 - app-')-\l - Ppp-T' = (E">"'')(E/^; 



k>0 k>0 



we find that for arbitrary n we have |a„(/)| < (Jo^M{n)^/n, where c7o,m(™) 
is the number of positive divisors of n that are prime to M, and a simple 
estimate leads to |an(/)| < 2n. □ 

The following lemma states a very well known lower bound for the Peters- 
son norm of a normahsed cuspform. 

11.1.2 Lemma Let N > 1 and let u = fdq/q be the holomorphic l-fonn 
onXi{N){C) attached to a cusp form f = J2n(^n{f)q'' in S2{ri{N)) with 
ai(/) = 1. Then we have: 



2 



Xi{N) 
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Proof We have uj = J2n> I'^ni f)Q"'dq/q in the coordinate q = e^'^*^, 
where z is the standard coordinate on the upper half plane H. If we let x 
and y be the real and imaginary parts of z we have: 

^00 Auj = Att'^I/I'^ dxdy 

Let F be the region in H given by the conditions \x\ < 1/2 and y > 1. 
Then: 



J^4n^\fiz)\''dxdy 

/1/2 POD 
™ „ -1/2 Jl 



m,n>l 



47r2^|a„(/)|2e-^-747rn. 



n>l 

From the first term (note that ai(/) = 1) we obtain ||a;p > 7re~^'^. □ 

We now specialise to a slightly less special case than our curves Xf. the 
curves Xi{pl) with p and / two distinct prime numbers. We call an Atkin- 
Lehner basis for Q,^{Xi{pl)) any basis of ^l^{Xi{pl)) given by an ordering 
of the set B2{pl). We start by describing, in a notation that is slightly differ- 
ent from the one used in (2.2.14), the degeneracy maps that are used for the 
definition of B2{pl). This time, we call them source and target maps: 

' sr. Xi{pl) ^ Xi{p), {E,P,L)^{E,P) 

tr. Xi{pl) ^ Xi{p), {E,P,L) ^ {E/{L),P) 

sp-. Xi{pl) ^ Xi{l), {E,P,L)^{E,L) 

_ tp: Xiipl) ^ X,{1), {E,P,L) ^ {E/{P),L) 

where {E, P, L) denotes an elliptic curve E with a point P of order p and a 
point L of order I. Note that si and t; have degree — 1, and that Sp and tp 
have degree p^ — 1. For any integer M > 1 we denote by $7^(Xi(M))'^™ 
the set of holomorphic 1 -forms in Q}{Xi{M)) of the form fdq/q with / 
in S'2(Xi(M))'^''^. Our next goal is to get information on the Gram matrix 
of an Atkin-Lehner basis of Q^{Xi{pl)). As described above, the contri- 
bution to n^{Xi{pl)) of each / in 52(ri(p/))'^^^ is the subspace Cfdq/q. 
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The contribution of an / in 52(ri(p))'^'^™ is the 2-dimensional space gen- 
erated by s*ifdq/q and t^fdq/q, and, of course, each / in 52(ri 
contributes the 2-dimensional space generated by s*fdq/q and t*fdq/q. 

11.1.3 Lemma For f in 52(ri(/))'^^^ and a; = fdq/q we have: 

{s;u;,s;u;) = ip^-l)\\uf, 

{t;u,t;uj) = {p'-i)\M\ 

{s*pUJ,t*pU;) = {p- l)ap{f)\\ujf. 
We have similar equalities with p and I switched. 

Proof The first two equalities are clear. As to the latter, note first that: 

{S*UJ, t*Uj) = ^ S*UjAt*UJ = ^ Sp,4s*U! A t*ui) = 

^ JXiipl) ^ ^ 2 Jxi{l) 

i 

^ 2 



Next note that Sp : Xi (pi) Xi{l) and tp : Xi (pi) — > Xi (/) factor through 
the forget map Xi{pl) Xi{l;p) where the latter curve corresponds to the 
moduli problem {E, P, G) with P of order I and G a subgroup of order p. 
This forget map has degree p — 1, and the correspondence on Xi{l) in- 
duced by Xi{l\p) is the standard Hecke correspondence Tp. We find that 
Sp,*t*uj = {p — l)T*uj. By the standard relation between eigenvalues and 
g-coefficients we have T*u! = ap{f)ui, so finally: 

(^0;,*;^;) = ^ / ojA{p-l)T;u; = ip-l)'^\\u;f 

as required. □ 

11.1.4 Corollary Let p and I he two distinct primes. The structure of the 
Gram matrix {{ui,ujj))ij of holomorphic 1-forms attached to an Atkin- 
Lehner basis for 0,^{Xi{pl)) is as follows. Two subspaces attached 
to distmct elements of the union of 52(ri(pO)°''™, 52(ri(/))'^™ and 
S'2(ri(p))'^^'^ are orthogonal to each other, hence the Gram matrix decom- 
poses into blocks corresponding to these subspaces. The contribution of an 
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eiemei3t/ii3S'2(ri(p/))°'=" is the 1-by-l block Wfdq/qW^. The contribution 
of an element f in 52(ri(/))'^<=" is the 2-by-2 block: 



where the norm \\fdq/q\\'^ is taken on Xi{l)). The contribution of an ele- 
ment f in 52(ri(p))"^^ is the 2-by-2 block: 



where the norm Wfdq/qW"^ is taken on Xi{l). 

11.1.5 Corollary The determinant of the Gram matrix of the holomorphic 
1-forms attached to an Atkin-Lehner basis forQ,^{Xi{pl)) is bounded below 

by {Tre-^'^y. 

Proof By the Weil-Ramanujan-DeUgne bounds (or, in this case, the Weil 
bounds, as the weight of the modular forms here is two), the determinant of 
a 2-by-2 block as in Corollary 11.1.4 is bounded below by H/ci^/o'll^. We 
obtain our corollary by invoking Lemma 11.1.2. □ 

11.1.6 Corollary The Arakelov (l,l)-form ji on Xi (pi) is given by: 



i sr^ioAuJ i ^ f {p + l)s*{uj A lo) + {p + l)t*p{uj A 



2g^ ' 29^\ {p-l)\\u;\\mp+lf-\aM\^) 



with the first sum running over fl^{Xi{pl))'^^'" , the second sum running 
over the third sum running over {Xi{p))''^'^ , and where 

is defined bycj = fojdq/q. 







f{l + l)s*iuj A s\uj + + l)tluj A t\u 
\ (Z-l)||a;P((Z + l)2-|aK/.)P) 
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Proof Consider first an arbitrary compact Riemann surface X and let 
a; = {uji, . . . ,Ug) be an arbitrary basis of ^1^{X). Let a := {co,uj) be the 
g-hy-g matrix given by Uij = {uji,u!j). Note that a = a*. Let b = a*'"^, the 
inverse of the transpose of a. Then we claim that the Arakelov (1, l)-form 
on X can be written as: 



To see this, note that for oj an orthonormal basis this is the correct expres- 
sion, and that changing to = u-g with any invertible g does not change jx, 
as one may directly calculate. 

In our case, the basis {uji, . . . , cu^) that we take is an Atkin-Lehner basis. 



We remark that Abbes and Ullmo have determined the Arakelov (1, l)-form 
on XQ{n) for all square free n > 1 such that Xo(n) has genus at least one 
in [Ab-Ul]. It should not be hard to generalise their result to Xi{n) for 
square free n. 

Now we arrive at the main result of this section. We recall that the Falt- 
ings height of a curve, and its stable or absolute version, have been briefly 
described in (4.4.1 1). 

11.1.7 Theorem For the stable Faltings height of Xi{pl), for distinct prime 
numbers p and I, one has: 



Proof This proof is an adaptation of an argument in Section 5 of [Co-Ed] 
where the case Xq (p) with p prime was treated. We may and do assume that 

Xi(pl) has genus at least one. 

We start with a general observation. For Xk a curve over a number field, 
and K ^ L a finite extension, we claim that: 




Using Corollary 1 1.1.4 one obtains the expression that we gave. 



□ 



KUMpm = o{{pifiog{pi)). 



[L : q]-'hL{XL) < [K : Q]-^/i;f (X^). 



This inequality simply results from the fact that for the Neron models of 
the Jacobians the identity morphism on the generic fibres extends to a mor- 
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phism: 

{JOk)Ol ^ JOl- 

For n a positive integer, we let X^(n)Q denote the modular curve corre- 
sponding to elliptic curves with an embedding of jin- The reason for con- 
sidering this variant of Xi{n) is that the cusp oo of X^{n) is Q-rational. Of 
course, Xi(n)Q and X^(n)Q become isomorphic over Q(Cn)> and therefore 
we have, for all n: 

Khs{Xi{n)q) = hahs{X^{n)Q). 

For more details about these Xn{n) we refer to sections 9.3 and 12.3 
of [Di-lm]. 

The general observation above gives: 

Khs{Xn{n)Q) < /iQ(X^(n)Q). 

Because of this, it suffices to establish the bound of the theorem for the 

hQiXf,{pl)Q). 

Let p and I be given, and let X be the model over Z of Xf^{pl)Q ob- 
tained by normaUsation of the j-line P| in the function field of X^(pl)Q. 
As X is proper over Z, the Q-rational point oo extends to an element oo 
in X(Z), which is known to lie in the open part X^'" of X where the struc- 
ture morphism to Spec(Z) is smooth, see [Di-lm]. In terms of the Tate curve 
over Z (((/)) = Z((l/j)), the cusp oo is the immersion of over Z, in the 
n-torsion of the Tate curve (see Sections 8.6-8.11 of [Ka-Ma]). 

We let J be the Neron model over Z of the Jacobian of the curve Xq. 
Then, by the defining property, the embedding of Xq into Jq that sends 
oo to extends to a morphism from to J. This morphism induces 
via puUback of differential forms a morphism from Goto (J) to S'(Z), the 
sub-Z-module of Q.^{Xq) of forms whose g'-expansion at oo has coeffi- 
cients in Z (see around (2.4.9)). As Goto (J) and 5(Z) are both Z-structures 
on n^{X{C)), we have (see around (4.4.10)): 

9 

hqiXQ) = deg(/\ 0* Coto(J)) = - log Vol((R ® Coto(J))/ Coto(J)) 
< - log Vol(M (8) S{Z)/S(Z)), 
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where the volume form on M (g) Goto (J) comes from integration over J(C), 
and that on M (g) S'(Z) from integration over X{C). 

Let T c End( J) be the Hecke algebra, generated by all Tj, i > 1, and 
the (a), a in (Z/plZ)^. We have a perfect pairing (see (2.4.9)): 

TxS{Z)^Z, {t,oo) ^ ai{tu). 

Using the duahty we can write: 

- log Vol(M ® S{Z) /S{Z)) = log Vol(R ® T/T) 

where the volume form on R (g) T is dual to the one on R (g) S{Z). Now 
consider an Atkin-Lehner basis {ui, . . . , Ug) of Q^{X)c. Let Vol' denote 
the volume with respect to the volume form on R (g) T induced by the one on 
C S{Z) for which the basis (wi, . . . , Wg) is an orthonormal basis. Then 
we have: 

log Vol(R (g T/T) = log Vol' (R (g T/T) - ^ logdet((a;,a;)) , 

where {co,oo) is the matrix whose (i, j)-coefficient is {oji,ojj). By Corol- 
lary 11.1.5 we have: 

-logdet((a;,a;)) < 3(47r - logTT) = 0((pZ)2). 

It remains to bound log Vol' (R (g T/T). Let T be the set of integers i > 1 
such that there exists an a; in U^{X{C)) with a zero of exact order i — 1 
at oo. Then F is the set of integers i > 1 such that h^(X{C), ioo)) 
is strictly less (and hence exactly one less) than h^{X{C), + l)oo). 

As h^{X{C),n'^) = g, and {X (C) , 0.^ {- {2g - l)oo)) = 0, there are 
exactly g such integers, and we can write T = {ii, . . . ,ig} with: 

1 = ii < 12 < ■ ■ ■ < ig < 2g — 1. 

Under the pairing between T and S{Z), each Hecke operator Tj is sent to 
the element co ai{uj) of the dual of S{Z), where the ai{oj) are given by 
the g-expansion: 

w = ^ ai{u)q' {dq/q) = ^ aj(w)g*"^ dq. 

i>l i>l 
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It follows that the elements Tj^ , . . . , Tj^ of the free Z-submodule T are lin- 
early independent. Hence T', the submodule of T generated by these Ti. 
has finite index. We thus find: 

logVol(M «) T/T) < log Vol' (M T'/T') - ^ log det((a;, w)) . 

Now we have g = ri + 2r2, where ri is the number of elements of our basis 
{cji , . . . , Wg) of C (8) that are fixed by the complex conjugation. We let: 

0: M T ^ R^i X X — > x 

be the map obtained from our basis (each gives 1 1— > ai{tuji)), composed 
with the projection. We view x as by decomposing each factor 
C as M © Ri. Then we have: 

Vol'(R ® T/T') = 2''\deti<f>{Ti^), 

By construction, each (j){Ti^)k is the real or imaginary part of some Ui- (ooi). 
Hence by Lemma 11.1.1 we have: 

\cP{Ti^)k\<2ij. 

We obtain: 

9 

|det(<^(T,J,...,<^(T,J)| < l[i2ij^) < (V)5. 

Hence, finally: 

logVol'(M(g)T/T) < r2log2 + £/(log4 + 21og£/). 
Noting that r2 < g/2 and that g = 0{{pVf) completes our proof. □ 

11.2 BOUNDEVG THE THETA FUNCTION ON PicS"^ (Xi [pi)) 

The aim of this section is to give a bound for the supnorm of the theta func- 
tion that occurs in Theorem 9.2.5. 

11.2.1 Theorem For X = Xi{pl), with p and I distinct primes for which 
the genus of Xi {pi) is at least one, we have log ||i?||sup = 0{{pl)^) . 
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We start with two lemmas, which are possibly of independent interest. 

11.2.2 Lemma Let X = V/A be a principally polarised complex Abelian 
variety and letH: V xV ^ C be its Riemann form. Let Ai , . . . , X2g be the 
successive minima of the lattice A, with norm defined by \\x\\'^ = H{x, x). 
Let (ei, . . . , e2g) be a symplectic basis of A, i.e., a basis with respect to 
which the matrix of the symplectic form Q{H) is, in g by g block form, 
equal to ( q )• "^^^ 



2» v.^-»+l'"^2s, 

where r is the period matrix in Mg corresponding to (ei, . . . , e2g). Here Vn 
denotes the volume of the unit ball in EJ^ with its standard euclidean inner 
product. 

Proof We consider the lattice M = Z-ei © • • • © Z e^ in the real subvector 
space W = M-ei © • • • © M-e^ of V. Denote by /ii, . . . , fig the successive 
minima of M, where the norm is given by restricting H to W (note that 
M is isotropic for the symplectic form, so that H takes real values on W). 
We have {H{ei, ej))ij = (9(r))^^, so that the volume (with respect to the 
inner product on W given by H) of W/M is equal to (det Q(t))~^^^, and 
hence by Minkowski's second fundamental inequality: 

^,, (det^(r))-V^ 
/^i • • • Ms < 2^ 77 • 

^9 

On the other hand we have: 

/^l • • • Afg > • • • = (Ai • • • X2g) ■ (Ag+l • • • \2g) ^ 

and since the volume of F/A is 1 we obtain by Minkowski's first fundamen- 
tal inequaUty: 

2^9 1 

Combining we find a lower bound: 

2^3 1 
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Combining this with the upper bound for /xi • • • //^ we obtain the required 
formula. □ 

11.2.3 Lemma Let N > 3 be an integer. The group Fi {N) is generated 
by its elements whose entries are bounded from above in absolute value 

by N^/L 

Proof We first note the following: let G be a group, and let 5 C G be a 
set of generators. Let X be a transitive G-set and let x be in X. For each y 
in X, let gy be an element of G such that gyX = y; we demand that gx = 1. 
Then the gJ'ySgy, for s in S and y in X, form a system of generators for the 
stabiliser Gx of x. To see this, first replace 5 by 5 U S~^. Let be in Gx- 
Write g = Sn - ■ ■ si with Si in S. Then we can write: 

g = Sn---si= g7^y^Sngy„ ■ ■ ■ ffj/j/i ^li^yi with yi = {si-i ■ ■ ■ si)x. 

The equahty holds because Siyi = yi+i, and gy^ = 1 and gs^yn = 1- 
Now we apply this to our case. We take G = SL2(Z), and we take X to 
be the subset of (Z/iVZ)^ consisting of the elements of order N. This is 
a transitive G-set. We let a; = (1,0); then Gx is identified with Fi(iV). 
Let S be the set consisting of ( J } ) and ( j 5 ) and their inverses. Then 
5 generates G. We now apply the previous argument to find generators 
of Ti{N). So let y = {a,h) be in X. Then, thinking of Z/NZ as the 
product of its local rings, we see that there is a w in Z with \u\ < N/2 and 
a + bu in (Z/iVZ)^ . Put ai := a + bu and bi := b. Then: 




Next, there is a v in Z with 1^1 < N/2 and 6i + aiv = 1 mod N, i.e.: 

mod N. 



Finally, let u) be in Z with \w\ < N/2 and with image ai in Z/iVZ. Then 
one has: 



mod N. 
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Writing out, we have: 

1 -u\ f I o\ /l w\ fo -l\ _ fw-u{l-vw) -1-uv 

I I \-v ijlo l/ll 0/~l l-vw V 



SO that we can put: 

9y = 9(a,b) 



w — ^(1 — vw) —1 — uv 
1 — vw V 



The absolute values of the coefficients of g(^a,b) smaller than iV^/4, if 
iV > 3, and the lemma follows. □ 

Proof [Proof of Theorem 1 1.2. 1] Recall that (z; r) is given by: 
{z-t) = (detS>(r))V4exp(-7rV(5>(r))-^y)|7?(z;r)|, 



where y = Q{z) and where r is a period matrix in the Siegel upper half 
plane Mg corresponding to X. We first deal with the factor det5>(r) and 
for this we invoke Lemma 1 1 .2.2. Choose once more an Atkin-Lehner basis 
{oji, . . . , ojg) for ri^(X). Using the dual basis in Q?-{XY we write: 

J(X) = CVA, 

where: 

A = Image (^i{X, Z) ^ C» : 7 j (wi, . . . , ojg)^ . 

The polarisation form for J{X) is given by: 

{z,w) ^ {{uj,uj))~j -w. 

Denote by || • \\p the corresponding norm on C^. We also consider the 
standard hermitian inner product on C^, which is just {z,w) i-^ ^z ■ w. Here 
we denote the corresponding norm by || • From the next two lemmas we 
obtain: 

and hence, by Lemma 1 1 .2.2, the estimate: 

\og{det^{T)) = 0{{plf\og{pl)). 
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11.2.4 Lemma The lattice A is generated by the subset of its elements x 
that satisfy < g-{pl)^^. 

Proof For the moment put N = pi. Following the natural surjections: 

ri(7V) ^ ri(7V)^b ^ Hi{Yi{N),Z) ^ Hi{Xi{N),1) 

we see that any generating set for ri(A^) gives a generating set for 
Hi{Xi{N),'L). We are going to take generators for Ti{N) as given by 
Lemma 11.2.3. In particular, the absolute values of their coefficients are 
bounded by N^/A. We have to see now what this implies for for cor- 
responding elements x of A. Concretely, choose ag = ( " d ) ri(7V). The 
image in A can be given as follows: choose any z in M and any path in H 
from z to gz. This gives us a loop in Xi (N), and the class of that loop is the 
image of g in Hi{Xi{N),Ij). In order to get to A we compute the periods 
of {uji, . . . , iOg) around this loop. We want to get bounds for these periods. 
In order to do this, note first that we can assume that c / 0. Indeed, the 
g with c = are unipotent, hence have trivial image in Hi{Xi{N),Z). 
Now we make the following choices. First, we want to take a z in H 
with = Q{gz). Since, for all z in M, Q{gz) = \cz + d\-'^Q{z), 

the condition that ^{z) = ^{gz) is equivalent to jcz + (i| = 1. We 
choose z = —d/c + i/\c\, i.e., such that cz + d = ±i, depending on 
the sign of c. Second, the path that we take is the straight line from z 
to gz. We have |c| > A'^ because g is in ri(A'^). Using furthermore that 
the absolute values of the coefficients of g are bounded by N^/A we get 
\gz -z\< \az + b\ + \z\ < (where we have used that N > 2). For 

the period of an element co = fdq/q of the Atkin-Lehner basis we obtain 
from this that: 



f-gz rgz rgz 

/ <^ = / f-idq)/q = I f-2mdw 



27riVii 

< 

- 10 



where w denotes the standard coordinate of H (i.e., the inclusion map 
into C), and ||/|| the supnorm of / on the straight line from z to gz\ re- 
call that q = exp{2Triw). When writing / = J2n>i^n{f)Q"' we have 
|on(/)| < 2n by Lemma 11.1.1. Noting furthermore that that we have 
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Qz = |c|-i > it follows that: 

-87riV-6n 2r 



ne 



n>l 



(1 - r)^ 



Hence: 



< {N^/Awf, and 



9Z 



where r 



- 10 



Are 
47r 



< AT 



23 



This means that all g coordinates of our element x of are, in absolute 
value, at most N'^^. Hence being the sum of the squares of these 

coordinates, is at most g-N^^ = g-{pl)'^^. □ 

11.2.5 Lemma For any x in we have the estimate: 

\\xfp< {e^'-MWxWl. 

Proof By Lemma 1 1.1.4 the matrix ((w, a;))~^ is almost diagonal, having 
in fact diagonal elements l/||ci;|p corresponding to newforms uj on Xi{pl), 
and 2-by-2 blocks corresponding to newforms oj on Xi{l) and Xi{p). The 
2-by-2 block corresponding to a newform u on Xi{l) is: 

1 [ p + 1 -opM ] 

{p-l)Mn{p + lY-\a,{u)\'^)\-a,{u) p+l 

where the norm ||a;|p is taken on Xi(l). 

The 2-by-2 block corresponding to a newform uj on X\ (p) is: 



/ + 1 



-ai{uj) 



il-l)\\com + ir-\ai{coW) \ -ai{u) l + l 

where the norm ||ci;|p is taken on Xi{p). 

A short calculation shows that for any {zi,Z2) in one has: 



Zl Z2 



W p+l -ap{oj) 



-ap{u) p+l 




(^.-l)((p + l)2-|a»n 
and similarly for Xi (p), so that all in all one gets: 



< {\Z1\' + \Z2\') 



[Zl,- 



< 



Zl 



+ ••• + 



12 ■ 



The lemma follows by the lower bound from Lemma 1 1 . 1 .2. 



□ 
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Next we consider the factor cxp(— tt *|/(9(r))~-'^y)|'i?(z; r)|. Since in our 
previous estimates the choice of r was irrelevant, it will cause no loss of 
generality here if we restrict to r lying in the so-called Siegel fundamental 
domain Fg, which is the set of matrices t = x+iy satisfying the conditions: 

1. for each entry Xij of x one has \xij\ < 5, 

2. for all 7 in Sp{2g, Z) one has det ^{'j-t) < det $J(t), 

3. y is Minkowski reduced, i.e., for each ^ = (^1, . . . , ^g) in 

and each i such that , . . . , are non-zero, one has 
^ 2/ *C > Uii and moreover, for each I < i < g — I one has 

yi,i+i > 0. 

It is well known that Fg contains at least one representative from each 
Sp(25, Z)-orbit on Mg. We claim that for r in Fg the estimate: 

holds, for all z in C^. Thus, this factor gives us a contribution 0{{pl)^). In 
order to prove the estimate, write y = Q{z) = {^{t)) ■ b with b in W. Then 
it is easy to see that: 

exp(-7r*y(3(T))-iy)|i?(z;T)| < ^ exp(-7r *(n + 6) (9(T))(n + 6)) . 

Since the $J(r) are Minkowski reduced we have, for any m in R^' (cf. [Igu], 
V§4): 

'm^iT)m>c{g)Y,mjmr))u, <9) = [^) [^) 
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Moreover, we have {^{T))i^i > V3/2 fori = I,. . . ,g. From this we derive: 

exp(-7r*(n + 6)(SJ(r))(n + b)) < 

n&B \ i=l J 
9 

^ IIIZ exp(-7rc(5)(ni + 6i)2(9(r))i,i) < 

' 2 

- M l-exp(-7rc(5)($5(r)) 



i=l riiGZ 

9 ^ 

< 

1=1 

2 \' 
< 2» ( 1 + * 



From this and the formula for c{g) the required estimate follows and the 
proof of Theorem 11.2.1 is finished. □ 



11.3 UPPER BOUNDS FOR ARAKELOV GREEN FUNCTIONS ON THE 
CURVES 

The aim of this section is to give an upper bound for the Arakelov Green 
functions on the curves Xi{pl) that will enable us to bound from above 
the contributions of the intersection numbers in the right hand side of the 
inequality in Theorem 9.2.5. As the Xi(C) are compact, it is clear that for 
each / such an upper bound exists, but we need such upper bounds that grow 
as most as a power of I. 

In order to establish such upper bounds we will use Franz Merkl's result 
on Green functions on arbitrary Riemann surfaces given in Chapter 10. 

Instead of using the result of Merkl for our work we could certainly also 
have used recent work by Jorgenson and Kramer in [Jo-Kr]. The results 
of Jorgenson and Kramer date back to the same time as those of Merkl 
(early Spring 2004). We chose to use Merkl's results because his approach 
is more elementary, and we had the details earlier than those of Jorgenson 
and Kramer. 

The following theorem gives a suitable upper bound for the Arakelov- 
Green functions ga^n (see (4.4.2) and Proposition 4.4.3) on the modular 
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curves Xi{pl) with p and I distinct primes. 

11.3.1 Theorem There is a real number c such that for all pairs of distinct 
prime numbers p and I for which the genus of Xi {pi) is at least one and for 
all distinct a and b on Xi (pi) (C) we have: 



Let oo denote the cusp oo on Xi{pl), and let q be the standard local coordi- 
nate around oo given by the map r exp(27rir) from the region > 1 
in M to C. Then we have: 



where || • || Ar denotes the Arakelov metric on Q (see Section 4.4). 

Proof We write for the moment N for pi. We will apply Theorem 10.1, 
but we will carry out the estimates on the more symmetrical modular curve 
X{N) whichforusisr(A^)\(MUP^(Q)). Leth: X{N) Xi{N) be the 
canonical map; it has degree N. We let denote the Arakelov (1, l)-form 
on Xi{N), and we define n' = h*ii,/N. The characterising properties of 
Green functions directly imply that: 



where the h are counted with multiplicity. 

As in Section 10 we fix a constant r\ with < ri < 1; we take ri := 3/4. 
We need to construct an atlas with charts z^-') : U^-'^ — C for X{N) with all 
([/(■?) ) containing the closed unit disk and with the Uf^ covering X{N). 

We start with a construction of a local coordinate z: C/ — > C in a neigh- 
bourhood of the standard cusp oo. Since SL2(Z/A''Z) acts transitively on 
the set of cusps of X{N), this construction will suffice to give the full atlas. 
Our initial coordinate is induced by the map z from M to C that sends r 
to e^'^*^/^. As the following lemma is valid for all integers n > 1, we state 
it in that generality, and will apply it with n := N. 

11.3.3 Lemma Let n be in Z>i. The subset in H given by the conditions 
-1/2 < 5Rt < n - 1/2 and > 1/n is mapped mjectively to X{n){C). 



gaAb)<cipif. 



\log\\dqUr{oo)\=Oi{plf) 



(11.3.2) 




h{b)=a 
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Proof First we note that for ( ^ ^ ) in SL2 (Z) and for r in H we have: 

' ar + b\ ^{t) 



CT + dJ jcr + dp 
Let us call D the set of r G H that satisfy the two conditions of the lemma: 

D = {r G M I -1/2 < sR(t) < n - 1/2 and S>(r) > 1/n}. 

Let T be in D, and let 7 = ( " ^ ) be in r(n), such that ^ t. If c = 
then, as ad = 1, we have a = d and r' = r ± 6 with b a non-zero multiple 
of n, and so t' is not in £). If c 7^ then we have |c| > n because n\c, and: 

aT + b\_ Q(r) ^ Q(t) ^ 9(t) 



cr + |cr + c/p - (S>(cr))2 - n\^{T)Y 



1 1 1 

< 



^^^(r) n2-(l/ra) 77,' 
hence 7r is not in D. □ 

In particular, the region of r with — 1/2 < 3?r < — 1/2 and ^Jr > 1/2 is 
mapped injectively into X{N) to give an open neighbourhood U of 00. We 
could replace the condition "S>r > 1/2" by "Gr > 1/7V", but that would 
not make the work to be done significantly easier. The map r ^-^irjN 
gives an isomorphism: 

(11.3.4) z:\J ^ D{0, e-""/^) C C. 

The region of r with —1/2 < !Kr < — 1 /2 and > 3/4 gives an 
open neighbourhood V of 00, contained in U, such that the translates of V 
under SL2(Z/ArZ) cover X{N) (note that 3/4 < The image of F 

under z is the disk Z)(0, e"^'^/^^). However, the quotient of the radii e~'^l^ 
and Q-^^l'^^ tends to 1 as A?^ tends to infinity, hence we cannot work with 
these disks directly. 

What we do instead is the following. We define a new coordinate 
z' := e^'^l'^^z to get z'V = I)(0, 1). Then z'U = Li(0, e'^/^^). Let 
£ := £{N) := e^l'^^ — 1 be the difference between the two new radii. Then 
£ > Tr/2N. We can choose 0{£~^) open disks D{a,£) with centre a in 
D{0, 1), such that the union of the D{a,£/2) contains D{0, 1); we let A 
denote the set of these a. The D{a, e) are contained in z'U = D{0, 1 + e). 
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The group SL2(Z/A^Z) acts transitively on the set of cusps of X{N). For 
each cusp c, we choose a gc in SL2(Z/A^Z) such that c = gcoo. The open 
sets of our atlas for X{N) are then the U^""''^ with a in A and c a cusp, 
defined by: 

[/("'^^ :=gc-{z')-^Dia,e). 

The required coordinates 2;("''=) on the i/^"''^) are defined by the composition 
of isomorphisms: 



^{a,c) . Jj{a,c) 



lj(a,oo) 



■D{a,e) 



Indeed, the images contain the unit disk, and J/^f'^^ corre- 

sponds via z' o g~^ to the subdisk D{a,e/2) of D{a,e), hence the Url''^^ 
cover X{N). The exact number n = n{N) of i/^"'"^) is the cardinahty of A 
times the number of cusps, hence n = 0{N^). We choose a numbering of 
A X {cusps} with the integers {1, . . . , n}, and we will denote our charts as: 



(11.3.5) 



zU): [/(j) ^ D(0,3/2) C C. 



11.3.6 Lemma For the local coordinates z^^ : U^^ Con X{N) that we 
have just defined, the following holds. For all j and k in {1, . . . ,n} we 
have: 



sup 



< M, 



with M = 6. 



Proof Let j and be in {1, . . . , n}. If j and k arise from the same cusp, 
then z^^^ and z^^^ differ by a translation, hence dz^^ /dz^^^ = 1. Now 
suppose that j and k arise from two distinct cusps. We may suppose then, 
by acting with an element of SL2(Z/A^Z), that k arises from the standard 
cusp oo. Let X denote the cusp that j arises from. The coordinate z(j') is 
then obtained as above from an element gx of SL2(Z) that sends oo to x. 
Let us write g~^ = ( " Note that c 7^ 0, hence |c| > 1. Let z be a point 
in M with -1/2 < < AT - 1/2 that maps to an element in u[^^ n u[^\ 
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Then we know that 1/2 < 3=^ < 1 because disks given by > 1 around 
different cusps do not meet at all. Likewise, we then know that: 



1 ^/az+^ 

2 \cz + d 



< 1. 



\cz + d|2 

Hence, as (9z)/|cz + dp < (Sz)/c^(Sz)^, we have < 2/c^ which 
gives in fact |c| = 1. Under these conditions, we estimate: 



log 



dexp(27rifi^/iV) 



log 



dexp{2Triz/N) 

az + b 

exp(27ri 

^ cz + d 



log 



exp(27ri^/iV)d 



jaz+b 

cz+d 



/N) 



exp(2mz/N)dz 
log |exp(27ri2:/A?")| — log \cz + d\'^ 

< 47r/Af + 47r/iV + log4. 



< 



So indeed, for > 6, we can take M = 6. Some explanations are 
perhaps in order here: as 3z and S(az + b)/{cz + d) are between 1/2 
and 2, |exp(27riz/iV)| and | cxp(27rifi^/iV)| are between exp(— 47r/A^) 
and exp(— tt/A^). As 9^(az + b)/{cz + d) = {^z)/\cz + dp, we see that 
|c2; + dp is between 1/4 and 4. □ 

Our next task is to produce a suitable bound, as in Theorem 10.1, of the 
type /i < ci jdz*^-') A dz'^^'>\. We start with a bound for ji on disks around oo 
on Xi{pl). 

11.3.7 Lemma Let r be a real number such that < r < 1. We map 

D{0,r) to Xi{pl) by sending q ^ to {C^ / q'^ , (pi) ■ The image of this 
map is the image in Xi{pl) of the region in H defined by the condition 
'Qr > —(log r) /2-k", plus the cusp oo. We still denote by ji the (1, l)-form 
on D{0, r) induced by ji. Then we have, on D{0, r): 

286^^^ 1 



TT 



(1-r 



71 ■ 2^<ldQ- 



Proof We first bound, on the disk D{0, r), and for a newform /, the func- 
tions En>i"n(/)5"""^ and E„>i an(/)9"'"^- We have, for |g| < r by 
Lemma 11.1.1: 

2 



li;a„(/)g«-i| < ^ M/)r-i < 2^ 



nr 



n-l 



n>l 



n>l 



n>l 



(1 
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and next: 



E«nW'"'l<2E"^"'"' = 7i^ forM<r. 

n>l n>l ^ ' 



Now recall from Corollary 11.1.6 that for jx we have the expression: 



z ^wAtJ i ^ f {p+l)sl{u ^UJ) + {p+l)tl{uj ^UJ) 

" (p-l)||a;P((p+l)2_|a,(^)|2) J 
i / + A s*cJ + (Z + l)f;cj A ifa; 

a-l)||a;|P((| + l)2-|aK/.)|2) ) ' 



the first sum running over ^}^{Xi(pl)y^™ , the second sum running over 
and the third sum running over We bound 

the different terms from the above expression for fi. The contribution of an 
Lo in gives, for l^l < r: 



2511^11 



n>l 



< 



9\M\' 

g IT \{1 — r^^ 

1 e'^'^ 4 



-dqdq 



-dqdq 



-dqdq 
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The contribution of an element ui of is: 



0^ 2^ 



2g^\ (Z-l)||a;P((/ + l)2_|a^(/^)|2) 

< 



ai{foj)s*iUJ A tju + ai{foj)t*iUJ A s\ 



(Z-l)||a;P((Z + l)2-|aK/.)P) 

1 e^^ /4(/ + l) 4(/ + Ijr-C-i) 
- 5 7r(/-l)3 1 (1 - r)4 + (1 - rl)^ + 



leVIr'- 



z _ 
dqdq. 



(l-r)2(l-r')M 2 

Here one uses the Weil bounds on ai^fi^). Symmetrically (in p and 1), the 
contribution to of an element u of (Z)"^^ is: 



E 



(p + l)s*a; A s^bj + {p + l)t*a; A t^uj 



2g^\ (p_l)||^||2((p+l)2_|„^(J^)|2) 

< 



ap{fu>)s*pUJ A t^a; + ap{f^)t*pCO A s*c<; 

" {p - i)\\u\\H{p + ly - , 

1 e'^'^ / 4(p + 1) 4(p + l)r2(P-i) 
- 5 7r(p- 1)3 I (1 -r)4 ^ (1 - rP)4 ^ 



' -dqdq. 



(1 - r)2(l - rP)2y 2 

Now we sum all contributions up, over the elements of Q,^{Xi{pl))^^'", 
JlH^i(p))"''"'andOi(Xi(0)"''^. We get for \q\ < r: 

4g47r / ^ -|^ ^2(1-1) 

^ - ^ 1 (1 - r)4 + (1 - r)4 + (1 - ^ (1 - r)2(l - r^f + 



1 j,2(p-l) 



I 



+ T, 1^ + vTT-, ^ • l^dqdq, 



and finally: 



(l-r)4 (l-rP)4 (l-r)2(l-rP)2 / 2 



286^^^ 1 i 

M< 7i U'ndqdq, for |g| < r. 

TT (1 — r)^ 2 



□ 
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Our next step is to consider the disks gU in X{pl), where g is in 
SL2(Z/plZ) and where U is as in (11.3.4). 

11.3.8 Lemma Let ghein SL2(Z/pZZ) andletziU ^ D{0, e'^'/P^) be as 
in (11.3.4). Let Zg := z o g-^ : gU D{0, 6"''/^'). Then we have, for the 
restriction to gU of the puUback h*iJLof ^ along h: X{N) Xi{N): 

{h*tJ,)\gu < c{pl)'^\dzgdz^\, 
with c independent ofp and I. 

Proof To prove this, we consider the map h o g o z^^ from D{0, e^^/'^^) 
to Xi{pl) and the puUback of to -0(0, e^^l'^^\ We observe that /i is in- 
variant under all automorphisms of X\{pl). This applies in particular to 
the diamond operators and the Atkin-Lehner pseudo-involutions (defined 
in (2.5.13)). As the group generated by these automorphisms permutes the 
cusps of X\(j)V) transitively, we can take such an automorphism a such that 
a o h o g o z~^ sends -D(0, e~^/P^) to a disk around the cusp oo, where 
we can then apply Lemma 11.3.7. The pullbacks of fj, via ho g o z~^ and 
a oho go z~^ are the same. We are also free to replace the coordinate z by 
with C G C such that |C| = 1. 

The map ho g o z^^ sends a point / (7 G D(0, e^'^/^') to the point of 
Xi{pl) corresponding to (C^/g^'^, Cp (g')^ Qiq^Y) for certain a and 6 in 
Fp and c and d in depending on g. After replacing h with h composed 
with a suitable diamond operator, and z by C,z with C, a suitable element 

of //p;(C), we are in one of four cases, that we will treat one by one. 

In the first case, q is mapped to (C^ /g^'^, C,pi)- Then the map ho g o 
factors as the cover D(0, e^'^/P^) — )• D{0, e~^) of degree pi sending q to 
followed by the map of Lemma 11.3.7 that sends q^^ to {C^/qP^^, (pi). Then 
we have, on L»(0, 

h*^^ < ■ -d{qP^)d{qPl) 

286^'^ 1 . ,x2 * , 

In the second case, q is mapped to (C^/g^'^, g', C;). In this case, 
we compose it with the pseudo-involution lu^^, which brings us to the 
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point (C^ /g'^, Cp, 0)- The map then factors as the Ith power map from 
D{0, e^'^/P') to D{Q, e-^'/P), followed by the map of Lemma 11.3.7 com- 
posed with a suitable diamond operator. We find: 

^ < 28e^ 1^ _ 

TT (1 - e-^/py 2 ^ ^ ' 

286^'^ 1 ,2 ^ , ^ 

- TT (l-e-Vp)4 2 ^ ^ 

The third case is obtained by interchanging the roles of p and I, so we will 
not make it exphcit. 

In the fourth case, q is mapped to (C^/gP'^,g). We compose with the 
pseudo-involution wc_^^, which brings us to (C^/g^, C,pi). This is the map of 
Lemma 11.3.7. We find: 

28e^^ 1 i 

In these four cases, we see that the factor in front of {i/2)dqdq in the 
upper bound for h*ii on D{0,e-''/P^) is Oiipl)^). This gives the required 
estimate on gU, as dq on D{0, e"'^/^') corresponds to dzg on gU. □ 

11.3.9 Lemma For the local coordinates z^^^ and the real (1, l)-form /j,' on 
X{pl) as defined in (1 1.3.5) we have: 

IJ,' < ci\dz^^^ Adz^^'^l 

on ?7p'^ withci = ci{pl) = 0{pl). 

Proof First of all, we have, by definition: n' = {l/pl)h* jJL. The definition 
of the z'^^^ (see 11.3.5) plus the definitions z' = e^'^l'^^h and e = e^/'^P'- - 1 
give: 

dz = -e-''^I^P'-dz^^\ 
3 

If pi gets large, then the factor ^'^I'^v^ tends to 1 and for e we have 
£ = (7r/2pZ)(l 0(l/pZ)). Combining all this with Lemma 11.3.8 fin- 
ishes the proof. □ 



We can now finish the proof of Theorem 11.3.1. We apply Theorem 10.1 
on X{pV) with the (1, l)-form /x'. Then we have n = 0{(j)l)^), M = 6 
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(Lemma 11.3.6) and ci = 0{pl) (Lemma 11.3.9). We obtain from (10.2) 
that there exists a constant c such that gh,n'{b') < c-{pl)^ for all distinct 
primes p and /, and all distinct h and h' on X{pl). For distinct a and a' on 
Xiipl) we then have (see (11.3.2)): 

5a,^(o')= 9b,^.'{h{a'))<c-{plf. 

h{b)=a 

The statement that log Hdz^-') ||Ar(-P) = 0{{pl)^) follows from the in- 
equality (10.3) in Theorem 10.1. Indeed, if locally we write ga^^ as 
ga,^l = log \z - z{a)\ + / then /(a) = - log \\dz\\Kr{a). □ 

11.4 BOUNDS FOR INTERSECTION NUMBERS ON Xi{pl) 

In this section, we will bound the intersection numbers occurring in the right 
hand side of the inequaUty in Theorem 9.2.5, in the situation described in 
Section 8.2. 

11.4.1 Theorem Letp and I he two distinct prime numbers, both at least 5, 
and let X be the semistable model over B := SpecZ[^p;] provided 
by [Ka-Ma]. For two cusps P and Q (possibly equal) in X{B) we have: 

{P,P)<0, and \{P,Q)\ = 0{{plf). 

For a cuspidal effective divisor D of degree g onX we have: 

\{D,D-C0;,/B)\=O{ipl)''). 

Proof As p and I are at least 5, the genus of Xi (pi) is at least two. By the 
adjunction formula (see (4.4.8)). we have —{P,P) = {P,ojx/b)^ by 
[Fall], Theorem 5, we have (P, ojx/b) ^ 0' hence (P, P) < 0. 

Let us now derive an upper bound for {P,ujx/b)- Xs the automorphism 
group of X over B preserves the Arakelov intersection product on X and 
acts transitively on the cusps, it suffices to do this for the standard cusp oo. 
The Fourier expansion at oo of the rational function j on X is of the form 
j = l/q + f with / G Z[[g]]. Therefore, l/j is regular in a neighbourhood 
of oo, and has a zero of order one along oo. It follows that d{l/j) generates 
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oo* uJx/B^ and d{l/j) = dq in oo* ujx/b- By definition of the Arakelov 
intersection product and Theorem 11.3.1 we then have: 

{,^,ux/b) = -MCpi)) ■■ Q]logMg||Ar(oo) = 0{{plf). 

We now know |(P,P)| = 0{{piy) for all cusps P in X{B). We will 
now show that \{P,Q)\ = 0{{piy). By the Theorem of Manin-Drinfeld, 
see [Dri], the image of the divisor P — Q in Ji{pl){Q{C,pi)) is of finite 
order. Let $ be a vertical fractional divisor such that for any irreducible 
component C of a fibre of X over B we have (P — Q — C) = 0. By [Hri] 
or Theorem 4 of [Fall] we have (P-Q-$,P-(5-$) = 0. Equivalently, 
we have: 

2(P, Q) = (P, P) + (Q, Q) - (P - Q, 

The term (P — Q, $) can be dealt with by the method used in the proof 
of Lemma 9.2.6. We work this out in this special situation. We make $ 
unique by demanding that its support is disjoint from P. Of course, this does 
not change the number (P — Q, $), but it makes it easier to talk about 
The support of $ is contained in the reducible fibers. These are exactly 
the fibers in the characteristics p and I. Let us estimate the contribution at 
the prime p. We have to sum over the maximal ideals of the Fp-algebra 
Fp[a;]/ (a;'~^ + • • • + 1). AH residue fields of this algebra are isomorphic to 
a finite extension F of Fp, and the number of them is (Z — 1)/ dimp^ F. Let 
be the fibre at one of these residue fields, and let $f be the part of $ that 
has support in -Yf. Then -Yf is the union of two irreducible components / 
and with transversal intersection at the supersingular points. The number 
of Fp-valued supersingular points is given by: 

{p-l){P-l) 



\S.S.\ 



' 24 

The degree on / of the restriction to it of OxiJ') is s, and, symmetrically, 
deg// Ox{I) = s. As / + /' = is a principal divisor in a neighbour- 
hood of Xp, the restrictions of Ox {I + I') to I and I' are trivial, we have 
degj Ox (I) = —s and degji Ox{I') = —s. It follows that $f is one of 
the following fractional divisors: $f = if P and Q specialise to points on 
the same irreducible component of X^; $f = if P speciahses to a 
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point on /' and Q to a point on /; <I>f = (1/s)-/' if P specialises to a point 
on / and Q to a point on If we denote by (P — Q, $)f the contribution 
to (P - Q, $) at the fibre Ap, we have: 

|(P-Q,^)F|<(2/s)-log#F. 

Summing this over the residue fields of Fp[x]/(a;'~^ + • • • + 1) gives, for 
the contribution (P — Q, $)p to (P — Q, atp: 



dimF,(F) s ^" (p- 1)0 + 1) 
Likewise, we have, for the contribution at Z to (P — Q, $): 

So, finally: 



The estimate |(P, Q)| = 0{{piy) now follows. 

To get to the second statement of the theorem, note that 

{D, D - ux/b) = {D,D + ojx/b) - 2P, cjx/b) 

= Y,iPk,Pl)-2{D,u;x/B), 
k^l 

where D = Pi + • • • + Pg, with repetitions allowed. By our previous 
estimates, we get \{D,D- ujx/b)\ = 0{g^{piy) = 0{{piy^). □ 

We will also need a lower bound for the intersection number of two distinct 
points on Xi{pl). 

11.4.2 Theorem There is an integer c sucii Aat for all pairs of distinct 
primes p and I such that Xi{pl) has genus at least one, for any extension 
K of Q(C5i) and for P and Q distinct points in Xi {pl){K) we have: 

where (P, Q) is the Arakelov intersection number of P and Q on the mini- 
mal regular model of Xi (pi) over Ok ■ 
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Proof We have: 

(P,Q) = (P,Q)fin + (P,Q)oo, 

with (P, Q)fin the contribution from the finite places of K, and (P, Q)oo the 
contribution from the infinite places. As P ^ Q, we have (P, Q)fin > 0. 
On the other hand, we have: 

{P,Q)oo=Y.-9a{Pa,Qa). 
c 

By Theorem 11.3.1 we have: 

ga{Pa.Qa)<c\vlf 

for some absolute constant c. This finishes the proof □ 



11.5 A BOUND FOR h{x\{Q)) IN TERMS OF h{bi{Q)) 

In this section we do what was promised at the beginning of Section 9.1, by 
stating and proving the following proposition and a corollary. 

11.5.1 Proposition There is a real number c such that the following holds. 
Let 6 be in Q, such that b^{b'^ + 116 - 1) 7^ 0. Let {u, v) in Q be a torsion 
point on the elUptic curve Ef, over Q given by the equation: 

(11.5.2) + {b + l)xy + by = x^ + bx^ , 

i.e., on the fibre at b of the universal elliptic curve with a point of order 5 
given in Proposition 8.2.8. Then the absolute heights h{u) and h{v) are 
bounded from above by c + 14/i(6). 

Proof Let b, u and v in Q be as in the statement of the proposition. We will 
now invoke known bounds for the difference between the Weil height and 
the Neron-Tate height on elliptic curves over number fields. Such bounds 
are given, for example, in [Dem], [Zim], and [Sil]. In [Sil] bounds are 
given for elliptic curves given by general Weierstrass equations, but under 
the assumption that the coefficients are algebraic integers. Therefore, for us 
it seems better to use the following bound in Zimmer's theorem on page 40 
of [Zim]. 
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11.5.3 Theorem (Zimmer) Let E be an elliptic curve over Q given by a 
Weierstrass equation = + Ax + B, and let P G -B(Q). Let h denote 
the absolute Weil height on P^(Q), and h the absolute Neron-Tate height 
on E attached to h. Then one has: 

- 2-^(2-^/i(l : : B^) + 71og2) < h{P) - h{P) < 

<2-^h{l:A^:B^) + 6log2. 

So, we must compare our plane elhptic curve Ej, with one given by a stan- 
dard Weierstrass equation. We put: 

vi:=v + {{b + l)u + 6)/2, ui:=u + {b + {b + lf/4)/3 . 

Then {ui,vi) is a point on the elhptic curve E'^^ given by a Weierstrass 
equation y'^ = x^ + Ax + B, with A and B polynomials in b, with co- 
efficients in Q, of degrees at most 4 and 6, respectively. We note that A 
and B depend only on b, not on (n, v). Using Lemma 4.2.3 and writing A 
as Aq + b{Ai + b{A2 + 6(^3 + 6^4))), we see that there is a real num- 
ber ci, such that for all b we have h{A) < Ci + 4,h{b). Similarly, there 
is a C2 such that h{B) < C2 + 6h{b). Therefore, there is a C3 such that 
h{l : A^ : B^) < 03 + 24h(b). Zimmer's theorem 11.5.3, plus the fact that 
the Neron-Tate height of torsion points is zero, tells us that there is a C4 such 
that for all b and for all torsion points {u, v) on Ej,, we have: 

h{ui,vi) <C4 + 12/1(6) . 

Expressing u and v in ui and vi, and using again Lemma 4.2.3, we get a 
real number C5 such that for all b and all [u, v) as in the proposition we are 
proving, we have: 

h{u) <C5 + Uh{b), h{v) < 05 + Uh{b) . 

This ends the proof of Proposition 11.5.1. □ 

11.5.4 Corollary There is a real number c such that for each I and each 
Qx,i as in the beginning of Section 9. 1 we have: 



h{x'iiQx,i)) < c+Uh{bi{Qx,i)). 
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Proof By definition (Section 8.2), x\ {Qx,'i) is the x-coordinate of a point of 
order 51 on the fibre at bi{Qx,i) of the elhptic curve E in Proposition 8.2.8. 



11.6 AN INTEGRAL OVER Xi(5Z) 

In this section we will give an upper bound for the integral appearing in the 
estimate in Theorem 9. 1. 1. We recall the situation: I is a prime number with 
I > 5, and b is the regular function on Yi(5)q given by Proposition 8.2.8. 
We also view 6 as a regular function 6; on yi(5/)Q via pullback along the 
map Yi{U)^ ^i(5)q that sends {E/S, P5,Pi) to (E/S, P5), where S is 
any Q-scheme, E/S m elliptic curve, P5 in E{S) everywhere of order 5, 
and Pi in -E'(-S') everywhere of order I. 

11.6.1 Proposition There exist real numbers A and B such that for all 
primes I > 5: 



where ji is the Arakelov (1, l)-form. 

Proof In order to simplify the notation in the proof, we will let Xi(5Z) 
denote the Riemann surface Xi(5Z)q(C) of complex points of the curve 
Xi(5Z)q over Q, and we will drop de subsscript / in bi. We will denote 
points of 11(5/) as triples P5, Pi) with E a complex elliptic curve, with 
points P5 of order 5 and Pi of order /. Similarly, we will denote points of 
11(5) by pairs {E, P), and points on the j-line just by elliptic curves. 

The equations in Proposition 8.2.8 show that the rational function b on 
Xi (5) has exactly one pole, that it is of order one, and that at that point, 
the function j : Xi (5) has a pole of order 5. The region in EI con- 

sisting of the r with 9(t) > 1 gives an embedding of the disk D{0, e"^'^) 
into the j'-line, sending q / to C^/g^. The inverse image of this disk 
under j : Xi{5) consists of 4 disks, one around each cusp. The two 

disks around the cusps where j is ramified are given by the embeddings 



L>(0,e-2V5) ^ Xi(5), sending g 7^ to {C''/q^^,q) and to (C^^/g^^, g^). 



As the integral in the proposition that we are proving does not change if we 



Proposition 11.5.1 gives the result. 



□ 
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replace 6 by its image under a diamond operator (a) with a G , we may 
and do suppose that b has its pole at the center of the punctured disk 

U = {(C^/g5^,g) : q e L>(0,e-2'^/5)*} C Xi(5) . 

The integral of log(|6p + 1)m over the complement of the inverse image of 
U in Xi{5l) is bounded by the supremum of log(|6p + 1) on ^i(5) — U. 
This upper bound does not depend on /. Hence it is enough to prove that the 

integral of log(|6|^ + over the inverse image of U in Xi (5/) is bounded 
hy B-l^, for a suitable B. Now this inverse image of ?7 is a union of 2(Z — 1) 
punctured disks Uc and with c and d running through F^^ given by: 

Uc = {(CVg'^g,Cf) : q e L>(0,e-2-/5)*} 

and: 

For each c in F^^ the map Xi(5l) — > Xi{5) restricts to the isomorphism 
Uc^U given q. For each d in F^^ , the restriction — > C/ is given 

by g g'. 

Around the standard unramified cusp of Xi(5Z) we have the punctured 
disk: 

Wi = {(CX/g^C5,0) : q e r»(0,e-2-/5)*}. 

By applying a suitable element from the group of automorphisms of Xi (5/) 
generated by the Atkin-Lehner pseudo-involutions and the diamond op- 
erators we can estabUsh isomorphisms of the Uc with Wi. The point 
(C^/gSZ^^^g) ^jjgjj g^g^ ggjj^ {C''/q^^,q,Ci) by (c-^), and 

then to {C^ /q^jCbjQ) by the Atkin-Lehner pseudo-involution that divides 
out by the group generated by the point of order 5 (see Definition 2.5.13). 

The coordinate q on Wi is then identified in this way with the coordinate q 
on Uc- We observe that /i is invariant under each automorphism of Xi{5l). 
Lemma 11.3.7 gives a real number Ci such that for all / and c, the positive 
real (1, l)-form // on Uc can be estimated from above by: 



fJ-lUc < Ci ■ ^dqdq. 
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Similarly, for each d in F^^ a suitable automorphism of Xi{5l) maps Vd to 
the punctured disk VF/: 

W{ = {(CV/,C5,0) : Q e Z)(0,e-2-/5')*}. 

Lemma 1 1.3.7 gives a real number C2 such that for all / and d, the positive 
real (1, l)-form /x on can be estimated from above by: 

Now the function g6 on U extends to a holomorphic function on a disk 
containing U, hence is bounded on U. Hence there is a real number 
C3 > 1 such that |6p + 1 < Qrlg^^l on U. It follows that on all Uc we 
have |6p + 1 < C3-|g~2|, and that on all Va we have |6p + 1 < C3-|g~2'| 
(note that under Vd U, {C" / q^^^ , , q^'^) is sent to (C^/g^'^, g'))- We 
remark that 1/(1 — e~^) = x~^{l + 0{x)) as x tends to from above. 
Hence there is a C4 G M such that for all I: 

(1 _ e-27r/5Z)4 - ^-^'^^ • 

We get, for all I: 

-2|^ i 



[ log(|6|2 + l);^<(Z-l)Ci / \og{Cs-\q-'\) ■ -dqdq 

Jb-W .yD(0,e-2"/B) ^ 

+ - 1)^2-^ / log(C3-|(?-2'|) • '-dqdq < 

< / f^Ci log(C3-|^r') + C2C4Z'log(C3-|^|-2')) ^dzrfz 
./|^|<i ^ ^ ^ 

< / (Cinog(C3-|z|-2) + C2C4/^log(C3-|z|-2))ldzdz 

= (Ci/ + C2C4/^)-(7r log C3 + tt) . 
This finishes the proof of Proposition 1 1 .6. 1 □ 



11.7 FINAL ESTIMATES OF THE ARAKELOV CONTRIBUTION 



We will now put the estimates of the preceding sections together, in the 
situation of Section 8.2. We briefly recall this situation. We have a prime 
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number I > 5, and Xi denotes the modular curve Xi{5l), over Q, and gi its 
genus. The Jacobian variety of Xi is denoted by Ji. In Ji{Q,){l] we have the 
Gal(Q/Q)-module V that realises the representation p from Gal(Q/Q) to 
GL2(F) attached to a surjective ring morphism /: T(l, k) ^ ¥ such that 
the image of p contains SL2(F). We have an effective divisor Dq on -'^i,Q(^;), 
of degree gi, supported on the cusps. For every x in V there is a unique 
effective divisor = Qx,i + • • • + Qx,gi of degree gi such that x is the 
class of Dx — Dq. We have written Dx = D^^ + i^S"^^, where D^"^^ is the 
part of Dx supported on the cusps. The numbering of the Qx,i is such that 
— Qx,i + • • • + Qx,dx- morphisms bi and x'^ from X; q to Pq 

that, seen as rational functions, have their poles contained in the set of cusps 
ofXi. 

The following proposition gives upper bounds for the absolute heights of 

the algebraic numbers bi{Qx,i) and x'i{Qx,i), polynomial in I. The height 
function h used here is as defined in (4.1.6). The proof of the proposition 
combines the involved arguments of the previous sections. 

11.7.1 Proposition There is an integer c, such that for all x in V as above, 
and for alii G {1, . . . ,dx}, the absolute heights ofbi{Qx,i) mdx\{Qx,i) are 
bounded from above by c-l^^. 

Proof We will just write 5 for bi. Let V be as in the proposition. Theo- 
rem 9.1.1 shows that for all x e V , all i & {1, . . . , dx} and all number fields 
K containing Q(C5;) over which Qx,i is rational, we have: 



.7.2) ' ^ " 



(11.7.2) 

' log{\b{' + l)^lx^ 



4e 




Here X is the minimal regular model of Xi over B := Spec Ok- 

Let us first concentrate on the second and third terms of the right hand 
side of (11.7.2). Theorem 11.3.1 gives an integer ci such that for all a 
we have supx^ 5<t < ci-f^, uniformly in all I. Proposition 11.6.1 gives an 
integer C2 such that for all a we have (1/2) log(|6p + l)nxa ^ C2-/^, 
uniformly in all I. Hence, for all x G V,a\li e {1,. . . ,dx} and all number 
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fields K containing Q(C5z) over which Qx,i is rational, we have: 

(11.7.3) h{h{Qx,i)) < ^^J^(Q^,,, 6*oo);i, + crl^ + C2-f , 

uniformly in all / and V. 

We now concentrate on the first term. We recall that 6*oo is an effective 
cuspidal divisor on Xi. Let x be in F. We apply Theorem 9.2.5, where (in 
the notation of that theorem) we assume that all Qx,i (i G {1, . . . ,gi}) axe 
if -rational and that K contains QiCbi), and that P is a cusp. We also use 
the obvious fact that log #R^p*0;f(D^) is nonnegative. That gives: 



[K:Q] - [K: 



+ ^log||i?|U,sup + |[if:Q]log(27r) 

+ ^degdetp*a;;t/B + (-Co,i')j • 
Theorem 11.4.1, applied with B = Spec{Z[(^i]), gives that: 
^^^\{Do,Do-U;,/s)\=0{l'% 



and that: 



^ :\iDo,P)\=Oif), 



[K: 

as Dq is an effective cuspidal divisor of degree gi and gi = 0{P). By 
Theorem 11.2.1 we have: 

By Theorem 1 1 . 1 .7 we have: 

j^-^^degdeip^ujx/B = 0{l^ log/). 



Finally, we have: 

.2 



j^^YJs^^^*^{s) = 0{l% 
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by the following argument. The only non-trivial contributions come from 
s over 5 and over The total contribution at 5 is independent of which 
extension K of Q(C5) we use, and for Q(C5) there is only one s over 5, 
k{s) = F5, and 6s equals the number of supersingular points in Xi(Z)(F5), 
which is 0{l^). The contribution from I can be computed over Q(0)- Then 
there is one s, and k{s) = F/, and 5^ is the number of supersingular points 
in Xi{5){¥i), which is 0(1) (see Section 8.1). 

Putting these last estimates together, we get that there is an integer C3 such 
that for all I and x we have: 

Now Dx is the sum of gi points Qx,i- In order to get upper bounds for the 
individual {Qx,i, P) we need a lower bound for these. Theorem 1 1.4.2 gives 
us a lower bound '^Qx,i^ P and Theorem 1 1 .4. 1 gives us one ii P = Qx,i- 
Putting these together, we get an integer C4 such that for all /, x and i: 

^ {Qx,uP)>crf. 



[K: 

The last two estimates together imply that there is an integer C5 such that for 
all I, X and i we have: 



-XQx,hP) < C5-1 



10 



[K: 

As 6*00 is an effective cuspidal divisor on Xi, of degree 0{P), the previ- 
ous inequaUty imphes that there is an integer cq such that for all I, x and 
i e {1,. . . , dx} we have: 

1 



-{Qx,i,b*oo)x < cq-1 



12 



[K: 

This finishes the proof concerning the height of bi{Qx,i). Corollary 11.5.4 
then finishes the proof. □ 

We recall, from the end of Section 8.2, that, in the situation as described in 
the beginning of this section, we take a linear combination /; := 6; + nx'i 
with < n < 5f(#F)^, such that under the map fi: q the 
divisors = Qx,i-\ \-Qx,dx' forx G V, have distinct images fi^^D^^. 
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Suppose that fi is any such Unear combination. The fi^^D^^ are then distinct 
effective divisors of degree dx on A^. 

For each x in V, we get a polynomial PdoJ^x with coefficients in Q given 
by: 

dx 

PD,JiAt) = \[{i-fl{Q-,i)) inQW' 

i=l 

and the map that sends x to PDo,fi,x is injective, and Gal(Q/Q(0))- 
equivariant. 

We have seen that there is an integer m with < m < g-{#¥)'^ such that 
the map: 

dx 

aDo,fi,m- V ^Q, x>-^ PdoJiA'^) = Yli^ - fli.Qx,i)) 

i=l 

is injective and hence a generator of the Q(Ci)-algebra ^i,Q(^;) associated 
with V. Assume that m is such an integer. The following theorem gives our 
final upper bound for the absolute height of the coefficients of the minimal 
polynomial: 

(11.7.5) Pd,j„„, = n - «^o,/<,m(x)) = E in mm 

xev j 

of aooJum overQ(O). 



11.7.6 Theorem There exists an integer c such that for all I, V, Dq, fi and 
m as above we have, for all Pj as in (11.7.5): 



Proof Let ci be an integer as given by Proposition 1 1 .7. 1 . Let I, V, Dq, fi 
and m be as in the theorem. For each x e V and each z in {1, ... , dx} we 
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have, by Proposition 1 1.7. 1, the definition of and Lemma 4.2.3: 

h{fi{Qx,i)) = h{h{Qx,i) + nx'i{Qx,i)) 

< log2 + h{bi{Qx,i)) + h{nx'i{Qx,i)) 

^ < log2 + h{bi{Qx,i)) + h{n) + h{x'i{Qx,i)) 

< log2 + + log (Z2-(#F)4) + crZ^2 

< 2cr/^^ + 21og/ + 41og(#F) + log2 
<C2-Z^' + 41og(#F), 

for C2 = ci + 1. 

In order to simplify the notation during the rest of this proof, we write 

a for (iDo,fi,m 

and P for PooJum- Then we have, for each x e V (using 
dx < and (11.7.7)): 

/ dx \ dx 

h{a{x)) = m (m - fi{Qx,i)) ]<Y.^{m- fi{Qx,i)) 



\i=l 



dx 



(11.7.8) < (log 2 + h{m) + h{fi{Qx,i))) 

i=l 

< d^- (log2 + log + C2-l^^ + 41og(#F)) 

where cs = C2 + 1. 

Let j be in {0, . . . , #V}. Then Pj is, up to a sign, the value of the 
elementary symmetric polynomial of degree — j evaluated in the a{x), 
where x ranges through V. Lemma 4.2.4, together with (11.7.8), gives us: 



/i(P,)<#F-log2 + ^%(x)) 



<#V- (log2 + C3-/i^ + 8Plog(#F)) 

where c = C3 + 1, and where we have used that log #F < I log I since F is 
a quotient of T(l, k) and k < I + 1. □ 

A last consequence of all Arakelovian estimates is the following upper 
bound for the term log #R^p*0;f(Dj;) in Theorem 9.2.5. 
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11.7.9 Theorem There is an integer c such that for alll > 5 prime and all x 
in V we have: 

^ log#RVO;t(Z?a.)<c-Z^°. 



[K: 

Proof We have akeady seen, in the proof of Proposition 11.7.1, that the 
right hand side of the inequality in Theorem 9.2.5, divided by [K : Q], is 
bounded from above by a constant times l^^. We have also seen in Theo- 
rem 11.4.2 that the term {Dx,P)/[K : Q] on the left hand side is bounded 
from below by a constant times (recall that is of degree 0{P)). This 
proves the inequality. □ 



This upper bound will be very useful for us, as the next interpretation shows. 
Recall that Xi has good reduction over Z[1/5Z]. 

11.7.10 Theorem There is an integer c with the following property. Let I, 
Xi, V and Do as in the beginning of this section. A prime number p J(5l is 
said to be F-good if for all x inV — {0} the following two conditions are 
satisfied: 

1. at all places vofQ overp the specialisation ^atv is the unique 
effective divisor on the reduction X, ^ such that the difference with 
D^f^ represents the specialisation ofx; 

2. the specialisations of the non-cuspidal part of Dx at all v above p 
are disjoint from the cusps. 

Then we have: 

^ logp < cl'^i#¥f- 
p not V-good 

Proof First of all, a prime number p satisfies conditions (1) and (2) for all x 
in y — {0} if and only if it satisfies them one of them, as Gal(Q/Q(C;)) acts 
transitively onV — {0} by assumption. 

We take K to be the extension of Q(0) that corresponds to the tran- 
sitive Gal(Q/Q(0))-set V - {0}; tiiis is tiie field of definition of one x 
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inV - {0}. Then [K : (Q] = 0{l-{#¥f). We define S{V) to be the im- 
age in Spec(Z[l/5/]) of the support in Spec(Oi^) of the finite O/^-module 
^^P*OxiDx). By Theorem 11.7.9 we have: 

log#(Z[l/5/] 0RVO^(i^;)) = 0(Zii-(#F)2), 

and hence: 

^ logp = 0(l"-(#F)2). 

pGS{V) 

We claim that the p in 5" (F) are precisely the primes p {5, such that 
condition (1) is not satisfied for x. To see this, we first note that for a 
morphism Ok — > the canonical map from (g)o^ R^p^Ox{Dx) to 
H1(X; Ox- {D^ f^)) is an isomorphism (see Theorem m. 12.1 of [Hart]; 
base change and cohomology in top dimension commute). The divisor 
D^. is the unique effective divisor in its linear equivalence class if and 
only if h'^{Xif ,0x- {D^f )) = 1, which, by Riemann-Roch, is equiva- 
lenttohHX^'/^,Ox^\Dj/j) = 0. 

Now we let T{V) denote the set of primes p {5, /} such that at least 
one specialisation of at a place of K above p is not disjoint from the 
cusps. Taking into account that [K : Q] = 0{l-{#¥f), equation (11.7.4) 
gives us an upper bound: 

(i^,,P) = 0(F-(#F)2) 
As the degree of Dx^^ is at most O(Z^), Theorem 1 1.4.1 gives us: 

m^^,P)\ = 0{fi#¥f), hence (Df , P) = 0(Z"-(#F)2). 
As the divisor Cusps has degree 0{l), we have: 

(L»f,CuSps) = 0(/12.(^j,)2)_ 

The intersection number (-D^°, Cusps) is the sum of {D^^^, Cuspsjan, the 
contribution of the finite places, and (-D;^", Cusps)oo, the contribution of the 
infinite places. We have: 

(Df ,Cusps)oo = Yl -9a{Qx,i,P), 
i,P,a 
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where the sum is taken over the i with I < i < dx, over the cusps P and the 
a : K C Then Theorem 11.3.1 gives the upper bound: 

(L'f ,Cusps)fin = (Df, Cusps) - (L'f ,Cusps)oo = 0{l'^im^)- 

By the definition of our set T(y) and the definition of (-D^", Cusps)fin we 
get: 

J2 logP < (^f, Cusps)fi„ = 0{l'^i#¥f)- 
peT{v) 

The proof of the theorem is then finished by noticing that the set of primes 
p ^ {5, 1} that are not F-good is precisely the union of S{V) and T{V). □ 
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Chapter Twelve 



Approximating Vj over tine complex numbers 

J.-M. Couveignes 

In this chapter, we address the problem of computing torsion divisors on 
modular curves with an application to the exphcit calculation of modular 
representations. We assume we are given an even integer A; > 2, a prime 
integer / > 6{k — 1), a finite field F with characteristic /, and a ring epi- 
morphism / : T(l, k) — > F. We want to compute the associated Galois 
representation pj : Gal(Q/Q) — )■ GL2(F). This representation lies in the 
jacobian of the modular curve Xi{l). Indeed, let /2 : T(/, 2) ^ F be the 
unique ring homomorphism such that f2{Tm) = f{Tm) for every positive 
integer m. Let Vf be the subgroup of Ji(Z)(Q)[Z] cut out by the kernel of 
/2. This is a dimension 2 vector space over F. Given a finite generating set 
(ti , . . . , tr) with r = (Z^ — l)/6 as in Theorem 2.5.12 we can rewrite Vf as 
a finite intersection 

Vf= f] kei{U,Ji{l){q)[l]). (12.1) 

l<j<r 

Then Vj realizes pf and we may write p/ as a morphism 

Pf : Gal(Q/Q) ^ GLiVj). 

We will assume that the image of pj contains SL(Vy). Otherwise pj 
would be reducible according to Theorem 2.5.18. And the reducible case is 
treated in Section 14.2. 

We want to compute the splitting field Kj of pj as an extension of Q. 
Computing Vf using general algorithms from computer algebra, like Buch- 
berger's algorithm, seems difficult in this situation because Vf is defined as 
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a subset of the /-torsion subgroup inside Ji{l). A naive algebraic descrip- 
tion of Vf would lead us to write down an equation for Ji (!)[/]; something 
similar to an Z-division polynomial for Ji{l). The degree of such a polyno- 
mial would be the cardinality of the group of torsion points, that is I'^si^i (0) 
where the genus g{Xi{l)) of Xi{l) grows quadratically in I. Such a degree 
is far too large for us: we are looking for an algorithm with polynomial time 
complexity in /. 

We describe below an algorithm for computing elements in Vf. This is 
a deterministic algorithm and the running time is polynomial in I. We shall 
work with the jacobian Ji(5/) rather than with Ji(/). We set 

X = Xi{5l) 

and we denote by g the genus of the latter curve. We note that the con- 
ditions above imply A: > 4, / > 19 and g > 289. Using the map 

^51.1,1 ■ Xi{5l) — Xi{l) defined in Section 2.2, and the associated mor- 
phism B'^i I ^ : Ji{l) -> Ji (51) between Jacobian varieties, we can see the 
subspace Vf as an F;-subspace inside the /-torsion of the jacobian 

J = Ji(5/). 

To avoid confusions we shall call Wf C Ji(5Z) the image of C Ji{l) by 
^51 1 V ^^^^ Ramanujan subspace associated with /. Elements 

in J are represented by divisors on the curve X. For every class in Wf, we 
compute a sharp enough approximation for some divisor in this class. It will 
be explained in Chapter 14 how one can compute the splitting field of this 
divisor from such a complex approximation, using the upper bounds for the 
naive height of torsion divisors on modular curves proven in Section 11.7. 

This chapter is organized as follows. In Section 12.1 we recall how points 
on X are represented using standard coordinates taking values in the com- 
plex unit disk. Section 12.2 recalls state of the art algorithms for computing 
the lattice of periods A of the jacobian J of the modular curve X. In Sec- 
tion 12.3 we describe an algebraic model for Xi(5/) and we relate it to the 
analytic model ri(5/)\H*. 

The four next sections collect useful intermediate results. Section 12.4 
provides exphcit inequahties relating coefficients and values of converging 
power series. In Section 12.5 we prove formal identities relating Jacobians 
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and Wronskians, that are necessary for the local study of the Jacobi integra- 
tion map. Section 12.6 collects simple quantitative facts about the Jacobi 
integration map. Section 12.7 relates several natural norms on the space of 
paraboUc modular forms of weight 4. 

A point on J can be represented in two different ways. We may con- 
sider it as a class x + A in C^/A = J(C). We may also fix a degree g 
divisor Q. on X and represent an element in J(C) by a divisor Q — m 
the corresponding linear equivalence class, where Q is an effective degree 
g divisor on X. In Sections 12.8 and 12.9 we adopt this latter point of view 
and we show that it is very convenient for computational purposes and leads 
to polynomial time algorithms. Unfortunately, the points we are interrested 
in (the x belonging to the Ramanujan subspace Wf) are rather difficult to 
characterize and compute in this form. However, assuming the divisor 
has been chosen correctly (e.g. we take for Q, the divisor Do constructed in 
Section 8.1), to every x in Wf there corresponds a unique divisor Qx such 
that Qx — ^ lies in the class represented by a;+ A G J(C). Such a Qx will be 
called a Ramanujan divisor. Computing x G is not too difficult because 
the defining equations of Vf given in Equation (12.1) become linear in the 
analytic model C^/A. The difficulty then is to compute Qx once given x. 
This is a typical example of the inverse Jacobi problem. Section 12.10 pro- 
vides a partial general solution for this inverse Jacobi problem: it explains 
how, given Q. and some x + A, one can find a divisor Q such that Q — Q. 
lies in the corresponding linear equivalent class. Since we are only working 
with approximations, we must control the error made in computing Q from 
X. The output divisor Q' is hopefully close to Q but most likely not equal 
to it. We call x' the image of Q' by the Jacobi integration map. Statements 
in Section 12.10 control the difference between x and x' . We can't hope a 
much better result in full generality since, in general, the divisor Q is not 
even unique, because x could lye in the singular locus of the Jacobi map. 
To relate the distance between Q' and Q and the distance between x' and 
X, we need some information about the local behavior of the Jacobi map at 
Q — Vt. Using results from Arakelov theory proven in Section 1 1.7, we show 
in Sections 12.11, 12.12 and 12.13 that when x lies in Wf then the error on 
X and the error on Qx are nicely related. This finishes the proof of the main 
Theorem 12.10.2 in this chapter. The last Section 12.14 provides a more 
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algebraic variant of this theorem. 

In this chapter, we shall use several times the main statements in Chap- 
ter 5 and in particular Lemma 5.4.12 and Theorem 5.4.3. These statements 
basically say that it is possible to compute efficiently sharp approximations 
of zeros of power series, provided we don't prospect near the boundary of 
the disk of convergence. In particular these zeros are well conditioned: they 
are not dramatically affected by a small perturbation of the series. 

We suggest that the reader look at the first pages and main statements in 
Chapter 5 before going further in this chapter. 

Remark. The symbol in this chapter stands for a positive effective abso- 
lute constant. So any statement containing this symbol becomes true if the 
symbol is replaced in every occurrence by some large enough real number. 

Remark. In this chapter the letter i stands for the square root of —1 in C 
having positive imaginary part. 

12.1 POINTS, DIVISORS AND COORDINATES ON X 

In this section we recall how points, functions, forms and divisors are rep- 
resented on a modular curve. We denote by T the classical fundamental 
domain for the action of SL2 (Z) on the Poincare upper half plane H. We set 
i:> = U 00. We set 




For every positive integer w we set 

Q<k<w-1 

We denote by the image of by the map z i-> exp(2?u;~^7r2;). This 
is a compact subset of the open disk Z)(0, 1) G C. It is even contained 
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in 15(0, exp(— vr/ii;)). Any cusp on X{C) can be written 7(00) for some 
7 G SL2(Z). These 7 can be chosen once for all with entries 

in absolute value. We denote by S the set of all these chosen 7. The set S 
parametrizes the cusps of X. We assume that the identity belongs to H. It 
parametrizes the cusp 00 itself. We write the topological space -^(C) as a 
union 

X(C) = U ^{D^^) = U U l{T\D)) 

7£ S 7G H 0<fc<ui-y — 1 

where is the width of the cusp 7(00). We say that the '^T^ arising in this 
union form a standard system of right cosets representatives for ri(5i) in 
SL2(Z). 

Every point on X is represented by a complex number z in ■~i{Dyj^ ) c H 
for some 7 in S. But 7""^ (2;) G D^^^ will often be more convenient. And 

= eiq){2iw^^'K^~^{z)) (12.2) 

is even more convenient. So most of the time, a complex point on X will be 
given as a pair (7,(/) where 7 G H and q G Fyj^ C L'(0, exp(— Tr/w-y)) is 
the value of q^ at this point. We set 

= 7(L>^^) C ri(50\H* = Xi(50. 

When 7 is the identity Id, we sometimes write q instead of qi^. The 
parameter q traditionally plays a more important role. Functions and forms 
on Xi{bl) are often identified with their q-expansions. The function field 
C(Xi (5Z)) can thus be identified with a subfield of the field of Puiseux series 
C{{g}}. In particular, we have an action of Aut(C) on modular functions 
and we can define the field Q(Xi(5/)) of Q-rational functions on Xi(5Z) to 
be the field of functions having ^'-expansion with Q-rational coefficients. 
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We define the distance 

between two points Pi = (7, gi) and P2 = (7, 92) in to be the modulus 
1 92 — 9i I of the difference of their coordinates. Of course dj extends to 
£'(0,1) DF^,. 

Given a complex number q in the open disk D{0, 1), let z G H U 00 be 
such that 

exp{2iw~^Tr'y~^{z)) = q. 

In the special case = we set 2; = 7(00). Such a z may not be unique. But 
two such z's are mapped onto each other by some power of 7 x T'^t x 7"^. 
Since the latter lies in ri(5i) we have defined a map 

/x^ : i:>(0,l) ^ Xi(5Z). 

This is the parameterization associated with 7. It sends F^^ onto D^. Any 
form (resp. function) on Xi{5l) can be lifted to D{0, 1) along the map n^. 
For example, Klein's modular function }{z) is usually given as a function of 
q = There exists a Laurent series 3{x) in the indeterminate x such that 
}{z) = J{q). Further 



J(a;) = i + 744 + ^ c{k)x'' (12.3) 



k>l 



where the coefficients c{k) are rational integers. It can be checked easily 
that the expansion of j at the cusp 7(00) is given by 



j(z) = J(g^'') (12.4) 

where is the width of the cusp 7(00). It is a consequence of a famous 
theorem by Petersson and Rademacher that the coefficient c{k) is bounded 
from above by 

e^. (12.5) 
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Now let d be a positive integer and let Q = Qi + Q2 + • • • + be a 
degree d effective divisor on X. Let e be a non-negative real number. We 
say that Q is e-simple if the following conditions hold true. 

1. For every integer k such that 1 < k < d, the point Qk belongs to Dy^ 
for a unique jk in H. So Qk = {jk,Qk)- We ask that qk hes in the 
interior of F^^. where Wk is the width of the cusp 7^(00). 

2. The distance between qk and the boundary of Fyj^, is > e. 

3. If 1 < fci < A;2 < d and 7^^ = 7^2 = 7, we write Qjtj = (7, gi) and 
Qk2 = il: Q2) and we ask that |g2 - 9i| > £• 

Not every divisor Q is e-simple but if e < l/{d@) there exists an e-srmple 
divisor Q' = Q[ + Q2 + ■ ■ ■ + Q'^ such that for every 1 < A; < cZ we have 
Q'k = ilk, q'k) and \q'^ - qk\ < @de. 

12.2 THE LATTICE OF PERIODS 

This section is devoted to the explicit calculation of the lattice of periods 
of X. All the algorithms in this section are detailed in the two books by 
Cremona [Cre] and Stein [Ste2] and in Bosman's thesis [Bos2]. See also 
Chapter 6. 

We need a complex analytic description of the torus J(C) as C^/A where 
A is the lattice of periods. We first compute an expUcit description of the 
first group in singular cohomology 



ery element in this basis is an integer linear combination of Manin symbols 



The 7 in the sum (12.6) runs over the standard system of right cosets 
representatives for ri(5Z) in SL2(Z). The integer coefficients Cy can be 
chosen to be 





(12.6) 



7 
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< exp(Z®) 



in absolute value. 
We also need a basis of the space of holomorphic differentials 



or equivalently a basis of the space S2{Ti{5l)) of weight two cusp forms. 
We shall use the standard basis made of normalized newforms of level 51 
together with normalized newforms of level I lifted to level 5^ by the two 
degeneracy maps. 

Let / = Ylk>v fkQ'^ ^ form in this basis. The g-valuation -y of / is 
1 or 5. The first non-zero coefficient in the q-expansion of / is 1. The 
coefficients fk in the g-expansion of / are algebraic integers. The modulus 
of fk is k®. One can compute an approximation of within exp(— m) in 
deterministic polynomial time (klm)®. 

The action of Atkin-Lehner involutions and wi is expressed in the 
basis by theorem 2 of [Asa]. The action of the diamond operators 
is known also because every form in is an eigenform for the Hecke 
algebra T^^') generated by the operators r„ for n prime to 5/. 

We also need the expansion of every form f{q) in B^^^ at every cusp 
7(00). More precisely, f{q)q~^dq should be rewritten as h{q^)q~^dq^ for 
every 7 in S. Since the level 5/ is squarefree, the group generated by the 
Atkin-Lehner involutions and the diamond operators acts simply transitively 
on the cusps. So there is an automorphism in this group that sends 00 to 
7(00). This automorphism can be represented by a matrix in GL2(Q) 
having integer entries as explained in Section 6.2 of Chapter 6. If 




then the width of the cusp 7(00) is 



_ 5^ 
gcd(5/, c) ■ 
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Let r be the unique integer in [0, tt;^[ such that d = cr mod w^. Set 
b' = b — ar and d! = {d — cr)/w^ and c' = c/ gcd(5i, c). Then 

= I T .,1 (12.7) 



and the product 



hlc' Wjd' 



fixes oo and it acts on Fourier expansions like the substitution q ^ (^q^/^-f 
for some root of unity ( = exp(^^). Since the action of on forms is 
known, we can compute the expansion of all forms in at all cusps in 
deterministic polynomial time {klrnf' where k is the g-adic accuracy and 
m the complex absolute accuracy of coefficients. 

Once we have computed a basis for both the singular homology 
H^^^^{Xi (51), Z) and the de Rham cohomology H^j^ (Xi (5/)) we can com- 
pute the lattice A of periods. Since we are given a basis B})-^ of holomorphic 
differentials, the lattice A is well defined inside C^dr as the image of the 
integration map Hf^^{Xi{5l), Z) C^dr sending a cycle c onto the vec- 
tor {Jc^)ojeB^^- "^1^^ image of the basis ^ by the integration map is a 
basis Bper of the lattice A of periods. The so-called matrix of periods has 
entries f^u where c is a cycle in the basis B^"^'^ of -f/J''"^(Xi(5/), Z) and 
CO = f{q)q^^dq is a form in the basis B^^ of H^^{Xi{bl)). Comput- 
ing these periods reduces to evaluating integrals of the form f{q)Q~^dq 
where a and are two cusps. We first cut this integral in two pieces 
Jafil)l~^dq = jf f{q)q~^dq - f{q)q''^dq. Since the group gen- 
erated by Atkin-Lehner involutions and diamond operators acts transitively 
on the cusps, we can reduce to the computation of integrals of the form 
f{Q)(r^dq where a = {a + bi)/c and a, b and c are integers bounded 
by in absolute value. Since the coefficient in the q-expansion of / are 
bounded by fc® we can compute approximations of the entries in the period 
matrix within exp(— m) in deterministic polynomial time (/m)®. 

We note that the norm on C^dr induces a distance dj on the quotient 
C^dr/A = j(C) 
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dj{x + A, y + A) = min \x — y — z 



(12.9) 



This distance will be useful when evaluating rounding errors in the course 
of numerical computations. We denote by 



the Jacobi integration map. This map is well defined once we have chosen a 
degree 1 divisor on X as origin. For any 7 in E, the restriction of (j) to Dj is 
Lipschitz with constant I® according to Equation (12.57). More precisely, 
if Pi = (7, qi) and P2 = (7, (?2) are two points in then 



For every positive integer k, we also denote by cj) the integration map 
(j) : X'^ ^ J . We denote by 



the map induced by (p on the group of divisors on X. The restriction of (j)' 
to the subgroup Div''(X) of degree divisors is independent of the origin 
we have chosen. 

12.3 MODULAR FUNCTIONS 

Since we plan to compute the spUtting field of some very special divisors 
on the modular curve X = Xi (51) we must be able to evaluate some well 
chosen modular functions of weight and level 5 or 5/ at a given point 
2; € H. In this section we describe algebraic models for Xi (5) and Xi (5/) 
and we explain how to compute the expansions of the involved modular 
functions at every cusp. 

12.3.1 The modular curve Xi (5) 

In this section we recall the definition of several classical level 5 modular 
functions and we show how to compute their expansions at each of the four 



(p:X ^ J 



dj{4>{P2)A{Pi))<i' 



X m - q\\- 



4)' : Div(X) ^ J 
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cusps of Xi (5). Let b be an indeterminate and consider the elhptic curve Ei, 
in Tate normal form with equation 

y'^ + {1 + b)xy + by = + bx'^ . (12.10) 

The point P = (0, 0) has order 5 and its multiples are 2P = (—6, b^), 
3P = (-6, 0), 4P = (0, -b). Call the projective hne with parameter b. 
The modular invariant of Ej, is 

(6^ + 1263 + 1462 _ i2b + 1)3 

Let 

ll + 5\/5 

' = — r- 

and s be the two complex roots of 6^ + 116 — 1. We call A^o, Aq, As, As 
the points on corresponding to the values oo, 0, s and s of the parameter 
6. The elhptic curve Ej, ^ — {A^o, Ao,As,As} is the universal ellip- 
tic curve with one point of order 5. So there exists a unique isomorphism 
between the modular curve Xi{5) = ri(5Z)\EI* and that is compatible 
with the moduli structure on either side. We want to compute this isomor- 
phism. More precisely we compute the expansions of 6 at every cusp of 
Xi{5). To this end we compare the curve in Equation (12.10) and the Tate 
curve [Tat2] with equation 

y'^ + x'y' = x'^ + a4x' + qq (12.12) 

where 

a4 = -5^a3(n) 



n>l 



06 = - 51 



5(73 (n) + 7c75(n) 



12 

n>l 



and g is a formal parameter. We note that the coefficients in the expansions 
above are integers and we have 

1 - E^iq) 



04 : 



48 

1 -3^4(9) + 2^6 (g) 
1728 
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where 

£;4(g) = l + 240^a3(n) 

n>l 

£;6(g) = l- 504^a5(n)g". 

n>l 

The modular invariant of the Tate curve in Equation (12.12) is 

j{q) = JJ^^^'^i^, , = - + 744 + 196884^ + • • • (12.13) 

Any isomorphism between the two Weierstrass curves in Equations (12.10) 
and (12.12) must take the form 

x = u'^x' + r (12.14) 
y = u^y' + su'^x' + t. 

Straightforward calculation gives the following necessary and sufficient 
conditions for the affine transform in (12.14) to induce an isomorphism of 
Weierstrass curves: 



1728E|(g) _ (64 + 1263 + 1462-126+1)^ 



El{q)-El{q) 65(62 + 116 - 1) 



2_ Ei{q) (62 + 1)(64 + 186^ + 7462 - 186 + 1) 
^ (64 + 1263 + 1462 - 126 + 1) 

^2 - 62 - 66 - 1 
r = — 



12 

u-h-l 



t = 



63 + 762 _ (5 ^ ^2)^ ^ ^ 



n2 



24 

We can simplify a bit these expressions. The first one just means 

From the classical [Sch3, Proposition 7.1] identities 

f)^i(i- 1728)^;. 
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and 



we deduce 



qdb\ _ Eaiq) bib"^ + 116 - l){b'^ + Ub^ + 146^ _ 126 + 1) 
E4{q) ^ 5(62 + i)(^4 + 1863 + 7462 - 186 + 1) ' 

So the expression for can be written 



The expansion of j as a series in q has integer coefficients and can be com- 
puted using Equation (12.13). We deduce the expansion of as a series in 



j-i + 744j-2 + 750420j-3 + • • • (12.17) 



It has integer coefficients and one can compute it from the expansion of j 
as a series in q using any reasonable algorithm for the reversion of a power 
series: brute force linear algebra or the more efficient algorithms in [Br-Ku] 
or the quasi-optimal algorithms in [Ke-Um]. 

We first study the situation locally at vloo- A local parameter for at A^o 
is 6"^. The expansion 

j-^ = -b-^ + 256"^ + • • • (12. 18) 

of as a series in 6~^ has integer coefficients and can be computed using 
Equation (12.11) and standard algorithms for polynomial arithmetic. We 
substitute (12.18) in (12.17) and find 

q = -6-5 + 256-^ + • • • 

One more reversion gives the expansion of 6"^ as a series in qs. 

b"^ = -q^ +5qi +■■■ . (12.19) 



This expansion defines an embedding of the local field at ^oo inside the 
field of Puiseux series C{{g}} in the formal parameter q. We deduce the 
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expansion of u from Equations (12.16) and (12.19) 



We also find 



u"^ =q— + Aq— + 4 - lOqs - 30g5 + • • • (12.20) 



-l-5g^ -lOgI +35gt +45g + --- (12.21) 



The coordinates of the 5-torsion P on Ef, are xp = and yp = 0. The 
image of P on the Tate curve has x' -coordinate 

, _9 2 3 4 

Xp = —ru = q5 + q5 + 2q5 —2q-\ 

Since on the Tate curve we have 

neZ ^ ^ ' n>l ^ 

we deduce that the value of the parameter w at the 5-torsion point P is 

w{P) = g^imod < q> . 

We may take either sign in the exponent above because we may choose any 
of the two isomorphisms corresponding to either possible values for u. We 
decide that 

w{P) = qimod < q> . (12.23) 

So the hmit curve when g ^ or equivalently when 6 ^ oo is a 5-gon, 
with a 5-torsion point lying on the second component after the one carrying 
the origin. So let 



7 



a b 

c d , 



be any matrix in SL2(Z) such that c is 2 modulo 5 and d is modulo 5. For 
example take 

In particular, the cusp 7(00) = 1/2 has width 5. We set 

q-y{z) = exp(2z7r7~''"(z)/5). 
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If we replace q^^^ by in Equations (12.19), (12.20) and (12.21) we obtain 
the expansions of b~^, and r at the cusp 7(00) = 1/2. Note in particular 
that -u^ is a modular function with weight —2 and level 5. By construction, it 
has no zero and no pole outside the cusps. Similarly 6 is a modular function 
with weight and level 5. By construction, it has no pole outside the cusps. 

We now study the situation locally at Aq. A local parameter at ^0 is h. 
We find = + 256*^ + • • • and = 6^ + 256'^ + • • • and we fix an 
embedding of the local field at Aq inside C{{g}} by setting 

}) = q\ -hqi + 15gi - SO^t -\ (12.24) 

Using Equation (12.16) we deduce 

= 1 - + 19gt - 40^5 + 55gt + . . . (12.25) 



and 



r = -ql + Aqi - lOqi + 15gt -{ (12.26) 



So the coordinate x'p of the 5-torsion point P is 

x'p = q^ + 2qi + 3gt + 5qt + 3q + 0{q 



and the parameter w at P can be taken to be w{P) = qsmod < q > this 
time. The limit curve when g — > or equivalently when 5 ^ is a 5-gon, 
with a 5-torsion point lying on the first component after the one carrying the 
origin. So let 




7 - 

be any matrix in SL2 (Z) such that c is 1 modulo 5 and d is modulo 5. For 
example take 

7 = 

In particular, the cusp 7(00) = has width 5. We set 
q-y{z) = exp(2z7r7~"^(z)/5). 
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If we replace g^/^ by in Equations (12.24), (12.25) and (12.26) we obtain 
the expansions of b, and r at the cusp 7(00) = 0. 

We now study the situation locally at Ag. A local parameter at is 6 — s 
and 

_i 1 IIV5 45443 4064^/5 2 



and 



125 + 55^/5 , -.^n /?^ 2 3375 + 1495^5 3 , 
h- s = q - (375 + 170V5)g^ q"^ + 



and 



2 25 + ll\/5 „ 3575 + 1595\/5 2 
= - (200 + 90V5)g —q^ + ■■■ 

and 

r = _I±|^ _ (100 + 45V5)g - (1300 + SSOv^)^^ + • • • 

and 

1 V5 5 + V5 , -15 + ^5 2 , , ,^ , 3 , 
xp = -- + — q+ q +(-10+V5)g +••• 

We note that the coordinate x' (P) of the 5-torsion point P is 

where w = cxp(^) = So the parameter w at P can be taken to be 
w{P) = C'i mod < q > this time. The limit curve when 6 — > s is thus a 
1-gon equipped with the 5-torsion point C5 in its smooth locus Gm- Let 



7 



a b 
c d , 



be any matrix in SL2 (Z) such that c is modulo 5 and d is 2 modulo 5. For 
example take 
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In particular, the cusp 7(00) = 3/5 has width 1. We set 

qj{z) = exp(2OT7~^(z)). 

If we replace q by in the expansions above we obtain the expansions of 
b, V? and r at the cusp 7(00) = 0. 

We finally study the situation locally at Ag. A local parameter at As is 
b — s and 

._i , 1 11^5,,^ , ,45443 4064\/5,,^ ,0 

7 = ( —)ib - s) - ( 1 —)(b -sY-\ 

^ 2 50 ^ ^ 125 25 ' 

and 

-125 + 55x/5 , /Tx 2 -3375 + 1495^5 3 
b-s= ^g + (-375 + 170V5)g2 + _ ^g^^--- 

and 

2 -25 + llv^ , -3575 + 1595^5 o 
= — — + (-200 + 90V5)g + —q^ + ■■■ 



and 



r = ^^^^ + (-100 + 45V5)g + (-1300 + 580V5)g2 + • • • 

and 

, 1 -5 + V5 15 + ^5 2 ,.r. /^N 3 

^^ = -2-10+^—^ ^,2-(10 + V5),3 + ... 

We note that the coordinate x'{P) of the 5-torsion point P is 

where w = exp(^) = Cs- So the parameter li; at P can be taken to be 
w{P) = mod < q > this time. The limit curve when 6 — > s is thus a 
1-gon equipped with the 5-torsion point ^5 in its smooth locus Gm- Let 



7 



a b' 
c d, 



be any matrix in SL2 (Z) such that c is modulo 5 and c? is 1 modulo 5. For 
example take 
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In particular, the cusp 7(00) = 00 has width 1. We set 

Qidiz) = exp(2z7r2;). 

If we replace q by in the expansions above we obtain the expansions of 
b, and r at the cusp 00. 
Altogether we have proved the following. 

12.3.2 Lemma (Computing expansions of b, and r) There exists a de- 
terministic algoritlim that given an integer k > 1 computes the k first terms 
in the expansions of b, and r at each of the four cusps of Xi(5), at the 
expense of fc® elementary operations. 

We recall that the functions b, and r are defined in Equation (12.15). 
Further 6 is a weight zero and level 5 modular function having no pole out- 
side the cusps. The weight — 2 and level 5 modular function has no zero 
and no pole outside the cusps. Finally r is the sum of two level 5 modular 
functions having no pole outside the cusps. One of weight —2 and one of 
weight 0. We also notice that the coefficients in the expansions of b, and 
r lye in Z or Lemma 12.4.9 impUes that there exists a positive 

constant G such that for every integer A: > 1, the A;-th coefficient in these 
expansions has absolute value < exp{@Vk). 

12.3.3 A plane model for Xi (5/) 

Let Z > 5 be a prime. We call Xi = Xi (51) the moduli of elliptic curves 
with one point of order 51. The genus of Xi is gi = (l ~ 2)^. In this section 
we define and study a natural homogeneous singular plane model Ci for this 
curve. In particular we enumerate the geometric points on Xi above every 
singularity of Q and we explain how to compute series expansions for affine 
coordinates at every such branch. Finally we recall how to compute the zeta 
function of the function field ¥p{Xi) for every prime integer p ^ {5,1}. 

Let b be an indeterminate and let Ei, be the elliptic curve in Equa- 
tion (12.10). The field Q(6) of rational fractions in b is the function field 
Q(Xi(5)) of the modular curve -^^1(5) over Q. The map 



B5i,5,i : Xi ^ Xi{5) 
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introduced in Section 2.2 defines a degree P — I extension Q(Xi)/Q{b). 
We construct an explicit model for this extension. The multiplication by I 
isogeny 

induces a degree P rational function on x-coordinates: 

N{x) 

where N{x) is a monic degree P polynomial in Q(6)[x]. Recursion for- 
mulae for division polynomials (see [Eng] section 3.6) provide a quick al- 
gorithm for computing this polynomial, and also show that the coefficients 
actually Ue in Z[b]. The roots of N{x) are the x-coordinates of the points Q 
on El, such that [l]Q is P = (0, 0). If Z is congruent to ±1 modulo 5 then 
IP = ±P and X divides N{x). Otherwise N{x) is divisible by x — 6. Call 
Ti(b,x) the quotient of N{x) hy x or x — b, accordingly. This is a monic 
polynomial in Z[6] [x] with degree Z^ — 1 in x. As a polynomial in x we have 



Ti{b,x)= J2 

0<fc<«2-l 

where ao(6) = 1. We call d be the total degree of T;. 

Let F be a field extension of Q{b) where Ti{b, x) G Q(6)[x] has a root. 
A suitable twist of the Tate curve Ei, given by Equation (12.10) has a point 
of order 51 defined over F. This proves that the function field extension 
Q{Xi)/Q{b) can be embedded in F/Q{b). Since the degree of r;(6,x) in 
X is equal to the degree of the extension Q(X;)/Q(&) we deduce that the 
polynomial T; is irreducible in Q(6)[x] and the quotient field Q{b)[x]/Ti 
is isomorphic to Q{Xi). Since the latter field is a regular extension of 
Q(6) = Q(Xi(5)) we deduce that Ti is absolutely irreducible. 

Let Ci C be the projective curve with homogeneous equation 
Ti{^, |)z'^ in the variables b, x and z. The map B^i^^^i : Xi{5l) Xi(5) 
is unramified except at 6 G {0, oo, s, s}. So for every point R on Xi such 
that b{R) {0, s, s, oo}, the function b — b{R) is a uniformizing parameter 
at R. Let U be the affine open set with equation 

zb(b2 - llbz + z^) 7^ 0. 
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Every point on CiHU is smooth and all points on Xi above points in Ci—U 
are cusps in the modular sense (i.e. the modular invariant has a pole at these 
points). The smooth point R = {bR,XR) on Ci nU is the moduh of the 
curve Ef,^ equipped with the unique 5Z-torsion point Q having x-coordinate 
xr and such that [l]Q = P E Ef,j^. 



12.3.4 The singularities of Ci 

We study the cusps of Xi{5l) that are mapped onto ^oo by -65; 51. Set 
Q = exp(^). Let a and /3 be integers such that < a, P < I — 1. Let also 
a and P be integers such that < a, /3 < Z — 1 and 

d = a/5 mod I 

and 

13= (/3-2)/5 mod/. 
We set WQ = Cfq^ q^i and observe that 

'Wq = Cr^^mod <q> 

and 

'^Q = Q'smod < q >= wp 

according to Equation (12.23). We denote by Q the point on the Tate curve 
in (12.12), having to-coordinate wq. The isomorphism given by Equa- 
tions (12.14) maps Q onto a 5Z-torsion point on the curve Ei,. This point is 
called Q also. The couple (E'5, Q) defines a point on Xi{5l) that is mapped 
onto {Eh,P) by i?5/,5,i. We substitute w by wq in expansion (12.22) and 
find 

x'Q = CfqU^{l + 0{q^i)) 

if < ^ < ^ and 

4 = cr"9^~^(i+o(9^)) 
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if ^ < /3 < ^ — 1- Using Equation (12.14) and the expansions in Equa- 
tions (12.20) and (12.21) we find 

a:Q + l = Cf 9^+^-^(1 + 0(9^)) (12.27) 

if < ^ < ^and 

XQ + l = C{^q^-Ti-i{l + 0{qTi)) (12.28) 

if ^ < ,9 < Z - 1. 
Let 




be any matrix in SL2 (Z) such that c is 5^ + 2 modulo 5Z and d is 5a mod- 
ulo 5Z. In particular, the cusp 7(00) = a/c has width w = ^^j^gf^- So w is 
5 if /3 = and 51 otherwise. We set 

qf{z) = exp{2i7rj~^ (z) / w) . 

If we replace q^^^ by q^ in Equation (12.27) or (12.28) above we obtain the 
expansion of x at the cusp 7(00) = a/c. 

The same method applies to cusps of Xi (51) that are mapped onto Aq, 
As or As by 55i,5,i- 

12.3.5 Lemma (Computing expansions of x) There exists a detenrnnistic 
algorithm that given an integer k > 1 computes the k first terms in the 
expansions of x at each of the cusps of Xi{5l), at the expense of (kl)^ 
elementary operations. 

We notice that the coefficients in these expansions of x lye in Z or 
TL\^-^^\ and there exists a positive constant such that for every inte- 
ger k > 1, the k-th coefficient in these expansions has absolute value 

< exp((A:0®). 

So we have a very accurate description of the singularities of Q since for 
every branch of Xi (5Z) above such a singularity we can compute expansions 
of both coordinates b and x as series in the local parameter q^. 
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We shall also need the following result due to Manin, Shokurov, Merel 
and Cremona [Manl, Mer, Cre, Fre]. 

12.3.6 Lemma (Manin, Shokurov, Merel, Cremona) For I a prune and 
p ^ {5, 1} another prime, the zeta function of Xi mod p can be computed 
in deterministic polynomial time in I and p. 

We first compute the action of the Hecke operator Tp on the space of 
Manin symbols for the congruence group ri(5Z) associated with Xi. Then, 
from the Eichler-Shimura identity Tp = Fp + p < p > /FpV/e deduce the 
characteristic polynomial of the Frobenius Fp. □ 



12.4 POWER SERIES 

In this section we give some notation and we state a few useful elementary 
properties of power series in several variables. We are mainly interrested in 
relating the size of coefficients in the expansions and the size of the values of 
the series where it converges. In the course of our calculations we shall en- 
counter three kinds of power series. Expansions of normahzed eigenforms 
have rather small coefficients, according to the Ramanujan conjecture. To 
deal with such expansions we introduce in Definition 12.4.2 the type of a 
power series. We shall also consider modular functions having no pole out- 
side the cusps. The coefficients in the expansions of such functions may be 
larger, but they are controled by the Petersson and Rademacher's inequality 
as explained in Lemma 12.4.9 below. Even more general modular functions 
may have quite big coefficients. To deal with this case, we introduce in 
Definition 12.4.13 the exp-type of a power series. 

12.4.1 The type of a power series 

Let 5( > 1 be an integer. The norm of a vector x = (.xi , . . . , Xg) <E 
is maxfe |a;^.| and it is denoted |x|oo- The norm is |x|i = |.Xfe| 
and the norm is |x|2 = \/J2k kfcP- We denote by ||x|| the vec- 
tor . . . , If y = {yi,...,yg) is another vector in we 
denote by x ★ y the componentwise product {xiyi, . . . ,Xgyg). We set 
Og = (0, . . . , 0) G Cff and = (1, . . . , 1) G and 2g = (2, . . . , 2). 
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If n = (ni, . . . , Hg) G W we write n! for the product ni!n2! • • • Ugl and 
x" for the product ^ • • • Xg". We note P(x, r) = HLi D{xk,rk) C C^, 
the poly disc with center x and polyradius r. When r = (r, r, . . . , r) we 
just write P(x, r). If x = (xi, . . . , Xg) G M^, we say that x > Og if and 
only if Xfe > for every k. We say that x > Og if and only if > for 
every k. An entire series / in the g variables x\, Xgi?, a formal sum 
/ = /kx"* where the index k runs over W. 

12.4.2 Definition (Type of a power series in several variables) Let A be 

a real number > 1 and consider n = (ni, . . . , Ug) G W such that n > Ig. 
We say that / is of type {A, n) if for every k > 0^, we have 

|/k|<A(k + lg)" = ^ \[ (A;^ + ir-. 

l<m<g 

For every z G P(Og, 1) we deduce an upper bound for the value of / at z. 



i/(z)i< J] A(k+i,nz>^i<A n Y.^^rn+ir-\z.^ 

k>Og l<m<9 km>0 

n\A 



kfi 

ml 



< 



'7711/ 

n!y4 



(lg-||z||)"+i.- 



(12.29) 



We check that if / is of type {A, a) and h is of type {B, b), then the product 
fh is of type 

(^P,a + b + lg). (12.30) 

12.4.3 Refocusing a power series 

Given an entire series / of type [A, n) and a vector 

C= (Cl,...,Cg) GP(Og,l) 

we set 

Pc(y) = Pc(yi, •••,%) 

= /(c + y ★ (Ig - ||c||)) = /((c^ + - |c^|))m)- 
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We call Fc the refocused series of / at c. According to [Cou, Lemme 16] 
this is a series of type (ylc, n + 1^) where 

Ac = nUexp(5 + |n|i)2S+l"li(lg- ||c||)-"-2«. (12.31) 

In particular, it converges for y G P{Og, 1). 

\2AA Bounding the remainder 

For any integer it > we denote by Ru{^) the remainder of order u of the 
series /(x). So 

/(x)= /kx^ + ^«(x)- 

|k|i<u-l 

According to [Cou, Lemme 17], if / is of type {A, n) and if r is a real in 
]0,l[andif z G P(Og,r) then 

|i?„(z)|<S(n + l)(-+i)^|z|^ (12.32) 

where n = |n|oo and 

^ _ rv\2Ag 

(1 _ r)3+|n|i • 

Further, if k is a real in ]0, 1 [ and if 

(log r)^ log r 

then 

|i?„(z)| <«;forzGP(Og,r). 
12.4.5 The type of a quotient 

Let / = /kx'^ be an entire series in the g > 2 variables xi, .. ., Xg. 
Assume that / has type {A, n) for some A > 1 and n > Ig. Assume 
that / is divisible by a polynomial P{zi, . . . , Zg). So there exists an entire 
series h = J2k ^kx"* such that / = Ph. We want to estimate the size of 
coefficients in h. We shall only need the case when P = Z2 — zi. So we 
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restrict to this special case. Let k = {k\, . . . ,kg). For every integer m such 
that 2 < m < 5 we set 



We set 



fci + 1 



If \ui — U2\ < I ^^^5^ — U2\ we set ui = Otherwise we set ui = iii. 

In any case 

1 ^2(A;i+ni + l) 



and 



and 



|1 — -uil ni 



J_ ^ fci + ni + 1 



I ^ 3(fc2 + n2 + 1) 



\U2—Ui\ n2 

From Cauchy's integral is equal to 

1 /• /■ /(<,!. ^2..... O 



-'ICoNUn (C2 — Cl) TTl^^v,^^ Cm" 



(27rz)9 ■ ■ ■ ((2 - Cl) ni<r„<g Cm- 

Using Equation (12.29) we find 



l<m<g 

So 

^ 3n!2"l+M(fc2 + n2 + 1) -j-r {km + nm + l)^'"+»-+^ 

li4, (km + 1)'- {nmT-^' 



So ^ has type (12n!2"i+l"li+s^exp(|n|i), n + 2 x 1^) 
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Now if we manage to divide f hy K polynomials of the form Zj^ — zj^ 
we obtain a series of type 

(Aexp(85K(|n|oo + 2Kf), n + 2Kx Ig). (12.33) 
12.4.6 The type of derivatives 

If / is an entire series in one variable of type {A, n), then the derivative /' 
of / is of type 

(^2",n + l). 
So the the d-Xh derivative of / is of type 

(A2'^"+^^,n + (i). (12.34) 



12.4.7 The Petersson and Rademacher's inequality 

The modular functions that appear in Lemma 12.3.2 are not modular forms: 
they have poles at the cusps. Since we plan to evaluate these functions at 
well chosen points z in the Poincare upper half plane, we must control the 
size of the coefficients in the expansions of these functions. 

Let / : H — )• C an holomorphic periodic function with integer period e. 
So f{z + e) = f{z) for every z G H. We assume that / is meromorphic at 
oo. So / can be written as a series 



e — 

where 

2m z 

Qe = exp(— — ) 

and V G -Z is the valuation of f at oo and the a k are the coefficients in the 
Puiseux expansion of / at oo, and the series F converges in the unit disk. 
Conversely, to every Puiseux series 



'->v 
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with radius of convergence > 1 we can associate an holomorphic function 
/ : EI — C having period e, and meromorphic at oo. 

By abuse of notation we say that / is a Puiseux series with radius > 1 
and period e. The set of all such functions is a ring. An example of such a 
series is provided by Klein's modular invariant ){z) = 3{q) where J is the 
series in Equation (12.3). In view of Petersson and Rademacher's inequality 
(12.5) it is natural to state the following lemma. 

12.4.8 Lemma (The Petersson and Rademacher's property) Let 



be a Puiseux series with radius of convergence > 1. Tlien the two properties 
below are equivalent 

1. There exist two positive constants Ki and such that for every 
integer k> K^we have 



2. There exist two positive constants K2 and K4 such that for every 
z = X + iy such that > K4 we have 



We say that such a Puiseux series is PR (Uke Petersson and Rademacher). 
The set of PR series is a ring which is integrally closed in the ring of Puiseux 
series with radius of convergence > 1. 

This lemma is easily proven: one imphcation results from Cauchy's for- 
mula and the other implication is trivial. Using Lemma 12.4.8 and the 
Petersson-Rademacher inequahty (12.5) we prove the following lemma. 

12.4.9 Lemma (Integral modular forms are PR) Let N > 1 be an inte- 
ger. Let / : H — > C be a modular function of weight for the group ri{N). 
Assume that f has no pole outside the cusps. So f is holomorphic on H, or 





(12.35) 




(12.36) 
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equivalently it belongs to the ring C [Yi {N)] of integral functions on Yi (iV) . 
Then the expansion of f at any cusp is PR. 

So the Petersson-Rademacher inequahty for the Fourier coefficients of j 
holds true for any integral function on Yi{N). We also prove the following 
lemma concerning the discriminant form. 

12.4.10 Lemma (The discriminant and its inverse are PR) Let 

n>l n>l 

be the discriminant form. The inverse of A is a PR series in q. 

This results from the product formula for A. We deduce that 
Lemma 12.4.9 extends to modular functions of arbitrary weight. 

12.4.11 Lemma (Integral modular forms are PR) Let N > 1 be an inte- 
ger. Let / : H — > C be a modular function of weight k £ Z for the group 
ri(A^). Assume that f has no pole outside the cusps. Then the expansion 
of f at any cusp is PR. 

12.4.12 The exp-type of a power series 

We shall have to deal with series in one variable having bigger coefficients 
than the ones introduced in Sections 12.4.1 and 12.4.7. The successive 
derivatives appearing in Lemma 12.1 1.2 are a good example. We no longer 
care about convergence then. We just want to control the size of the (loga- 
rithms) of the coefficients. 

12.4.13 Definition (Exp-type of a power series in one variable) Let n be 

an integer > 2 and let A and B be two real numbers > 1. We say that an 
entire series / = Ylk>o fk^^ exp-type (A, n) if for every A; > we 
have 

IM <exp((Afc + B)"). 

If /i is of exp-type (Ai, Bi, ni) and /2 of exp-type {A2, -B2, 712) then the 
product /1/2 is of exp-type 
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(^i + A2,Bi+-B2 + l,n) 



(12.37) 



where n is the maximum of ni and n2. 

If / is of exp-type {A, B, n) and A; > 1 is an integer, then the k-th power 
is of exp-type {kA, kB + k — l^n). The derivative /' = df/dx of f is 
of exp-type 



If / is of exp-type {A,B,n) and g{x) = 1/(1 — xf{x)), then g is of 
exp-type 



12.5 JACOBIANS AND WRONSKIANS OF POWER SERIES 

In this section we state and prove an algebraic identity relating Wronskian 
and Jacobian determinants. This identity will be useful to control the local 
behaviour of the Jacobi integration map. We first state this identity in its 
simplest and most natural form in Section 12.5.1. We then state a more 
general identity in Section 12.5.2. The proofs are given in Sections 12.5.3 
and 12.5.4. 

12.5.1 A special case 

We assume that </ > 2 is an integer and we consider g entire series fi{x), 
/2(.x), . . . , in one variable x, with coefficients in C. The Wronskian 

associated with f = (/i, . . . , /g) is the determinant 



{A,A + B + l,n). 



(12.38) 



(VA + 5 + l,0,2n). 



(12.39) 



Wf(x) = 



1 



(12.40) 




X 



(9-1) 



(x) 
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We may also introduce g inde terminates yi, y2, ■ ■ ■ , Vg and define the Jaco- 
bian associated with f to be the determinant 



Jf = 



h{yi) ■■■ fg{yi) 
/i(y2) ••• fg{y2) 



fliVg 



faiVaJ 



Let now D = Yl};^^{ym — yk) be the reduced discriminant. Then the 
Jacobian J7f hes in the ring C[[yi, . . . , y^]] and is divisible by the reduced 
discriminant in this ring. Further, the quotient Ji/Dis congruent to Wf (0) 
modulo the maximal ideal of C[[j/i, . . . , j/g]]: 

^ = Wf{Q) mod (yi, 2/2, . . . , yg)C[[yi, yg]]. (12.41) 



A proof of this identity is given in the next Sections 12.5.3 and 12.5.4. 

Now assume that all the series fk{x) have type {A, n). Then the Jacobian 
Jf has type 

We deduce from Equation (12.34) and (12.30) that the Wronskian Wf has 
type 



{A^ exp(en5^ + Qg'^),gn - 1 + 



(12.42) 



12.5.2 A more general identity 

Let (7 > 2 be an integer Let IK be any field with characteristic zero. Let 
fi{x), .. ., fg{x) be g entire series in one variable x having coefficients in 
K. Let f = (/i, . . . , /g) be the corresponding vector Let 1 < n < y be an 
integer and consider the n first derivatives 

f(o)^ f(i),...,f("-i) 
of f with respect to the variable x. The exterior product 

f(n-l) 



f(0) f(l) 

IT 



W^^n=--^A--j^^---A e A mW (12.43) 
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is a sort of partial Wronskian associated with the vector f . 
Now let 5 > 1 be an integer and let 

n = mi + m2 + • • • + ms 

be a partition of n in 5 parts. In particular rus is a positive integer for every 
1 < s < S. Let yi, y2, • • • 5 be S distinct indeterminates and consider the 
corresponding partial Jacobian 

^Umsh<s<s = ^f,mi(yi) A Wi,^M • • • A Wi^^,{ys) (12.44) 

in 

n 

Let 

^{ms)\<s<s 11 vy«2 ysi) 

l<Si<S2<S 

be the corresponding partial weighted discriminant. The following identity 
is a partial generalization of Equation (12.41) 



= W^f,n(0) mod (j/i,y2, . . . ,y5). (12.45) 

In particular i7f,(ms)i<s<5 is divisible by the weighted discriminant 
^{ms)i<s<s in *e . . . , y^JJ-module A" {Hivi^ Vs]])^- A proof 

of this identity given in the next Sections 12.5.3 and 12.5.4. 

Now let K > 1 be an integer and let 

g = ni+n2-\ \-nK 

be a partition of the dimension g. So is a positive integer for each 
1 < k < K. We consider K vectors fi, . . . , f^- in (]K[[a;]])^. We introduce 
K indeterminates xi, . .., xk and following Equation (12.43) we define the 
total Wronskian to be 



^{h,nu),<k<K = A ^h,nk{xk) G K[[xi,X2, . . .,xk]]. (12.46) 
l<k<K 
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For every 1 < A: < K let 5^ be a positive integer and let 

rik = mk,i + mk,2 H h mk,Sk 

be a partition of into Sk parts. For every 1 < k < K and 1 < s < Sk 
we introduce the new indeterminate yk,s and following Equation (12.44) we 
define the total Jacobian to be 



■^(fk,{ink,s)l<s<S,.)l<k<K A ^ffe)(»"fe,s)l<s<S^ (12.47) 



i<it<js: 



in 



We set 



and 



and 



'^[[{yk,s)l<k<K-\<s<Sk\\- 



n — {nk)l<k<K 



m = ('Tlfe,s)l<fe<i<:;l<s<5fc- 



Both m and n are partitions of g. And m is a refinement of n. We define 
the discriminant relative to m and n to be 

l<k<K l<k<K l<si<S2<5fc 

Collecting K equations like (12.45) we obtain 



= ^ifk,nk)i<k<K (0) mod iyk,s)i<k<K; i<s<Sk ■ (12-48) 



This generahzation of Equation (12.41) will be useful in Section 12.13.3 
when studying the Jacobi map. We now prove it using a formal analogue of 
the Jacobi map. 
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12.5.3 Proof of Equation (12.45) in a special case 

In this section assume that S = n and mi = m2 = • • • = ms = 1. We 
write f as a series in x with coefficients in 

f = + ^r^a; + ^20;^ + • • • e 

where 

f(fe) 

*ik = -^(0)GK3 
for every k > 0. We consider the formal integration 

F = [ {{x)dx = ^QX + ^a;2 + + • • • G K<^[[x]]. 

Jo 2 6 

We introduce S new indeterminates yi, ...,ys and we set 

= F(yi) + --- + F(y5) el^^[[yi,...,ys]]- (12.49) 

We denote by 

tn= (yi,...,j/5)]K[[j/i,...,y5]] 
the maximal ideal in ]K[[yi, . . . , ys]]. For every A; > 1 we call 

i^k = yi + --- + ys 

the k-th Newton's power sum. We check that 

^1 ^5-1 
$(yi, ...,ys) = *oz^i + -^z^2 H 1 + R 

where the remainder i? is a vector in . . . , ys]])^ whose coefficients 

are symmetric functions in the (y6)i<6<s and belong to m^+^ So these 
coefficients belong to IK[[z^i, . . . , vs\] and for every 1 < A; < S" the partial 
derivative ^ is zero modulo 

n = mn]K[[i^i,...,i^5]] = {vi,...,vs)'K[[vi,...,vs\]- 
We deduce that for every 1 <k < S 

— = mod n. (12.50) 

ovk k 
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On the other hand, it is clear from the definition of $ in Equation (12.49) 
that for every 1 < s < 5 

^ = ^(y.) = fW. (12.51) 

Finally, for every 1 < k < S and 1 < s < S we have 



and the determinant 



dys 



dys 



= s\ n iys2-ys,)- (12.52) 

^='■5 1<S1<S2<5 



Equation (12.45) then follows from Equations (12.50), (12.51) and 
(12.52) applying the chain rule for derivatives. 

12.5.4 Proof of Equation (12.45) in general 

We introduce the n indeterminates Xgj for 1 < s < 5 and 1 < j < rus- We 
put the lexicographic order on these indeterminates and we apply Equation 
(12.45) to the series f and partition n = l + l + -- - + l. We obtain 

f(a;i,i) A •••Af(a;s,^g)=(Wf,„(0)+O(i;i,i,...,a;s,ms)) 

X n(l,l)<(siJi)<(s2J2)<(S.'"s)(^''2.J2-^n.M) (12.53) 

where 0(xi^i, . . . , xs,ms) stands for any element in the ideal generated by 

Xl,l, Xs,ms in ■ ■ ■ , Xs,ms]] ■ 

We introduce S new indeterminates yi, ys- We also introduce n 
indeterminates Zgj for 1 < s < S" and 1 < j < m^. For every 1 < s < 5 
we consider f (y^ + z) as a series in z with coefficients in We apply 

Equation 12.45 to the series f{ys + z) and partition = 1 + 1 + • • • + 1. 
We obtain 

f(2/s+2s,l)A---Af(2/s+^s,ms) = (l^f,ms {ys)+0(Zs,l,...,Zs,ms)) 

X Ul<ji<j2<msi^s,j2-^',h) (12.54) 

We now replace Xgj by ys + Zs,j in Equation (12.53) and we obtain 

f(yi+zi,i) A ■■■Af{ys+zs,ms)=iWt,n{0)+O{yi,...,ys,zi,i,...,zs,mg)) 

X n(l,l)<(3i,3i)<(s2,J2)<(S,ms)(2/s2~2/si+^S2J2~^si.Jl) (12.55) 



bookarxiv March 23, 2010 



APPROXIMATING Vp OVER THE COMPLEX NUMBERS 



301 



We now notice that the left hand side of Equation (12.55) is the wedge prod- 
uct of the left hand sides of the S equations like (12.54). Further, the dis- 
criminants on the right hand sides of the S equations like (12.54) divide the 
discriminant in the right hand side of Equation (12.55). So we equate the 
right hand side of Equation (12.55) and the wedge product of the right hand 
sides of the S equations like (12.54). We then divide by the product of the 
S small discriminants. We then reduce modulo the ideal generated by the 
variables Zs,j and we obtain 

as was to be proven. 

12.6 A SIMPLE QUANTITATIVE STUDY OF THE JACOBI MAP 

In this section we prove some upper and lower bounds for the Jacobi map. 
Upper bounds are rather trivial but important to control the complexity of 
the algorithms. Lower bounds are not very surprising either. But they play 
an important role in the proof of Theorem 12.10.1. 

12.6.1 Upper bounds for the Jacobi map 

We first prove that the Jacobi map is Lipschitz with constant Z®. Indeed 
let 7 G H and call 0^ = (f) o ji^ the composition of the Jacobi map 
^ : X — > J(C) with the modular parameterization ji^ : D{0, 1) X. 
So 



and we don't need to specify the origin of the integral here. Every 
oj = f{q)q''^dq in B^-^ can be written h{q^)q~^dq^ where h{qj) is the 
expansion of the modular form / at the cusp 7(00). It is a consequence of 
Ramanujan's conjectures proven by DeUgne and the explicit formulae by 
Asai for pseudo-eigenvalues that the series h{q^)q~^ is of type 




(6,6). 



(12.56) 
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Therefore if qi and q2 belong to D{0, exp(— vr/ty-y)) D F^^ the integral 
Jq^ h{q-y)q^^dqy is bounded in absolute value by \q2 — qi \ times accord- 
ing to Equation (12.32). So the Jacobi map is Lipschitz with constant 



< r. (12.57) 
We now consider some vector 7 = {'jk)i<k<g € and we call 

the composition of the Jacobi map (/) : -> J(C) with the product of the 
modular parameterizations 

For every 1 < A; < we set w^, = w^^,. Let q = (gi, . . . , qg) with 
qk G £'(0, exp(— Tr/tLJfc)) for every 1 <k < g. We study the map cj)^ locally 
at q. The tangent space to D(0, 1)^ C at q is identified with and we 
denote by ((5fe)i<fe<g its canonical basis. The underlying M-vector space has 
basis ((5i, . . . , . . . , i5g). For 1 < A; < 5 we set Sk^^g = 18^. Similarly 

we call {ek)i<k<g the canonical basis of = C^dr and set ek+g = ick 
ior 1 < k < g. So {ek)i<k<2g is a basis of the M-vector space underlying 
C^. Let Dq<j);^ be the differential of 0^ at q. For 1 < /c < 251 let pk be the 
image of 6k by this differential. The determinant of D^cf);:^ 

Pl A ■ ■ ■ A P2g 

ei A . . . A e2g 

is the square of the absolute value of the Jacobian determinant 

u 



dq. 



Ik 



(12.58) 



We shall need an upper bound for the absolute value of i7^(q). As a series 
in the g indeterminates qi, q2, . . . , qg, iht Jacobian J"^ has type 

(exp(e52),eig). (12.59) 

This results from Equation (12.56) and the definition of JZ^ in Equa- 
tion (12.58). If 7 = (7, 7, . . . , 7) is the repetition of g times the same 7 in S, 
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we write for and we denote by W.y{q) the Wronskian associated with 
J^. This is a series in one variable q. We deduce from Equations (12.42) 
and (12.56) that has type 



12.6.2 Lower bounds for the Jacob! map 

We now bound from below the Wronskian W^{q) and the Jacobian ^^(q) 
for some special values of q and q. So we assume that 7 = (7, 7, . . . , 7) 
is the repetition of g times the same 7 in H and we study the Jacobi map 
(j) : — > J in the neighborhood of (7(00), . . . ,7(00)) where 7(00) is 
the cusp associated with 7. The parameter at the cusp 7(00) is the g-y from 
Equation (12.2). 

We first treat the case when 7 = Id and we write jToo (resp. W^) for Ji^ 
(resp. Wia). We denote by 



the denominator that appears in the definition of the Wronskian in Equa- 
tion (12.40). The expansions m q = qi^ of the ^ for a; G ^S^j^ are entire 
series with algebraic integer coefficients; and they are permuted by the ab- 



We set 77 = The product Woo{q){dqY is a degree rj holomorphic 

form on X. Therefore it has 2{g — l)ri zeros counting multiplicities. Since 
the g- valuation v of IVqo {q) is the multiplicity of the cusp 00 in the divisor of 
VFoo(g)((ig)'', we deduce that i; < 2{g—l)-q. So the series x lyoo(^)^ has 
valuation 2v < 2{g — l)g{g+l) and rational integer coefficients. Wededuce 
from Equations (12.60) and (12.30) that the type of the series Woo (9)^ is 



(12.60) 



m! 



l<rri<g— 1 




(exp(e5'),e/). 



(12.61) 



We write 



9 
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where c is a non-zero rational integer and R2V+1 is the remainder of order 
2v + 1. We can bound this remainder using Equations (12.32) and (12.61). 

|i?2.+i(g)|<exp(ez6)|g|2-+i. 

So if 1^1 < exp(-e/6) we have |Woo(g)^| > 2^ x q'^^9-i)9{9+i) and 

\Woo{q)\ > X > exp(-e/5) X (12.62) 

2Gg 

So we fix such a q. For example we take 

q = 10-«i'' (12.63) 

for some large enough positive constant ki. We set 

(l=qlg = {q,...,q) (12.64) 

and X = {xi, . . . ,Xg) where a:;i, . . . , are new indeterminates. The Jaco- 
bian 

Joo(q + x^(lg- ||q||)) 

is an entire series in the g variables xi, Xg. This is indeed the Jacobian 
associated with the g series 

(/(g + x(l-|g|))/(g + x(l-|g|)))^(g),- 

in the variable x. Equation (12.41) gives us the first non-zero term in the 
expansion of this series at x = 0^: 

Joo(q + x*(lp- ||q||)) = "W^oo(9)(l- kl)^^ n^^"*-^*^) 



k<m 



+ -^ g(g-i) I -1 (x) 
2 """-^ 



The type of the Jacobian i7oo(q) as a series in q is given by Equa- 
tion (12.59). We deduce from Equation (12.31) that the refocused series 
i7oo(q + X * {Ig — ||q||)) is a series in x of type (exp(0(/^), 61^). Using 
Equation (12.32) we deduce that for x in P(Oc,, exp(— tt)) 

g(g-i) _(.i 

^ g(g-i) I i(x) < exp(e5 )|x|oo^ 
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9 9 9 



(12.65) 



and s < exp(— tt). Then 



W^{q){l-\q\y-^ll{xi-Xk) 
k<l 



We take 



> \WM\ 



9(g-i) 

S \ 2 



s = 10- 



(12.66) 



for some large enough positive constant K2. Using Equations (12.63) and 
(12.62) we obtain the following lower bound for the Jacobian 



|Joo(q + x(l -g))| > exp(-e/^^) (12.67) 

when q, q, and x are given by Equations (12.63), (12.64), (12.65), and 
(12.66). In particular |q + x(l — q)\^ can be assumed to be < exp(— 27r). 
So 

max Uoo(q)| > exp(-eZ^^). (12.68) 

qeD(0,exp(-27r))9 

In order to bound from below J'^ for any 7 G S we observe that J'^ and 
J' are closely related: If w is the width of the cusp 7(00), there exists a 
w-th root of unity and an algebraic number of absolute value 1 (the 
product of all pseudo-eigenvalues) such that the following formal identity 
in C[[qi, . . . , qg]] holds true 

Jj{qi, ...,qg) = XjJooiC-rQi, QiQg)- (12.69) 
So the lower bound in Equation (12.68) is also valid for every J^. 
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12.7 EQUIVALENCE OF VARIOUS NORMS 

The main algorithm in this text (the one in Section 12.8) uses a subroutine 
that computes the complex roots of an analytic function on a compact set. 
This problem is well conditioned according to Lemma 5.4.12 of Chapter 5, 
provided we have a decent lower bound for the maximum of the function in 
question. In our situation, the analytic functions are derived from quadratic 
differentials on X. We need simple conditions for these functions not to 
be uniformly small in absolute value in the neighborhood of any cusp. The 
second inequality in Equation (12.71) below provides such a condition. In 
order to prove this inequality we study Jacobians associated with weight 4 
cusp forms on X, locally at every cusp. 

12.7.1 Space of quadratic differentials 

In this section we shall make use of parabolic modular forms of weight 4 
on X. To every such form f{q) one can associate a quadratic differential 
u = f{q)q~^{dqf' . The divisor of uj is related to the divisor of / by the 
following relation 

Div(a;) = Div(/) - 2Cusps 

where Cusps is the sum of all cusps. Note that Xi(5Z) has no elhptic point. 
The map f{q) i— )■ f{q)q~'^{dq)'^ defines a bijection between the space of 
weight 4 parabolic forms and the space "H^ (Cusps) of quadratic differentials 
with divisor > — Cusps. We denote by g2 the dimension of the latter space. 
This is 3^' — 3 plus the degree of Cusps (the number of cusps). 

We shall need a basis Bquad for the space (Cusps) or equivalently a 
basis for the space S4{Ti{5l)) of weight four cusp forms. We shall again 
use the standard basis made of normalized newforms of level 51 together 
with normalized newforms of level / lifted to level 5/ by the two degeneracy 
maps. We also need the expansion of every form in ^quad at every cusp 
7(00) for 7 € H. More precisely, f(q)q^'^{dq)'^ should be rewritten as 
h{q^)q~'^{dq^)'^ for every 7 in H. As for degree 1 forms, and using the same 
methods, we can compute the expansion of all quadratic forms in Bquad at 
all cusps in deterministic polynomial time {klrnf' where k is the g-adic 
accuracy and m the complex absolute accuracy of coefficients. 
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We now define several important norms on the space "H^ (Cusps). If w is 
a form in ^^(Cusps), we denote by |a;|oo the norm in the basis -Squad- 
To every cusp 7(00) with 7 G S we associate a norm on ?{^(Cusps). We 
define \oj\^ to be the maximum of the modulus of the function ujq^{dq^)~'^ 
for \q^\ < 1/2. 



a; U = max 

l97l<V2 



{dq^Y 



(12.70) 



Any two such norms are of course equivalent: their ratios are bounded by 

a constant. More interestingly, the logarithm of this constant factor is poly- 
nomial in the level 5/ of X: for any 7 in S and any uj in (Cusps) we 
have 

Z~® X |a;|-y < |a;|oo < exp(Z®) x (12.71) 
These inequalities will be proven in Section 12.7.3. 

12.7.2 Jacobian of weight 4 cusp forms 

Remind that we have constructed in Section 12.7.1 a basis Squad for 
the space (Cusps) of quadratic differential forms. If 7 G 'BP'^ and 
q = {Qk)i<k<g2 we define the quadratic Jacobian 



(q) 



(12.72) 

l<fe<92,weSquad- 



It is a consequence of Ramanujan's conjectures proven by Deligne and the 
exphcit formulae by Asai for pseudo-eigenvalues that the series is of 
type 

(G,e). (12.73) 

for every oj in Hquad and every 7 in S. So the series in the 52 variables qi, 
(I2, (lg-2 defined by Equation (12.72) is of type 

(exp(e/^),ei5,). (12.74) 

Further, if 7 = (7, . . . , 7) G H^^ jg repetition of g2 times the same 
7, we write ^7"^ for J^^^ and we denote by W^^^ the corresponding 
Wronskian. This is a series in one variable q and it is of type 



bookarxiv March 23, 2010 



308 CHAPTER 12 



(exp(eZ^),eZ^). (12.75) 

We need a similar estimate to Equation (12.68) for these quadratic Jaco- 
bians J^^^. We first treat the case when 7 = Id and we write (resp. 
W^^) for J^^^ (resp. W^^^). We denote by 

l<m<g2 — 1 

the denominator in the definition of W^^"^. 

The expansions in g = qi^ of the for 00 G (Cusps) are entire 
series with algebraic integer coefficients; and they are permuted by the ab- 
solute Galois group of Q. So the series G^^ x W^^{qf has coefficients in 
Z. We set r/2 = ^^^±2). The product W^^{q)q-3^{dq)'^^ is a degree r/2 
form on X and it is holomorphic outside Cusps. More precisely, it belongs 
to (52 Cusps). Therefore it has 



2{g - l)r/2 + 92 deg(Cusps) < @f 



zeros counting multiplicities. We deduce that the g-valuation V2 of 
W^'^'^iq) is < So tiie series G]^ x WX'^'^iqf has valuation < eZ^ 
and rational integer coefficients. We deduce from Equations (12.75) and 
(12.30) that tiie type of tiie series W^^^{qf is 



(exp(e/^),GZ^). (12.76) 



We write 



W^^{qf = -^q^^- + R2.,+,{q) 
92 

where c is a non-zero rational integer and R2V2+1 is the remainder of order 
2v2 + 1. We can bound this remainder using Equations (12.32) and (12.76). 

|i?2.2+i(9)|<exp(ez6)|g|2-2+i. 

So if \q\ < exp(-e/6) we have {W^'^'^iq^l > ^ \q\^'"'' and 

\W^^{q)\ > exp(-ez5) \qf'" . (12.77) 
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So we fix such a q. For example we take 

q = IQ-'^si^ (12.78) 

where K3 is a large enough positive constant. We set 

ci = qlg, = iq,...,q) (12.79) 

and X = {xi,. . . , Xg^) where xi, Xg^ are new indeterminates. The 
Jacobian 

is an entire series in the 52 variables x\, Xg^. This is indeed the Jacobian 
associated with the 52 series 



(/(? + x{l - \q\))/{q + x{\ - |g|)))/(g)q-2(dg)2es, 



quad 



in the variable x. Equation (12.41) gives us the first non-zero term in the 
expansion of this series at x = Og^ : 



jr''i(q + x*(l,, - ||q||)) = WX^{q){l - \q\Y-^ \{{.xi - xu) 



k<l 



+ -^ 92(92-1) I 
2 ^ 



The type of the Jacobian J'^^'^{q) as a series in q is given by Equa- 
tion (12.74). We deduce from Equation (12.31) that the refocused series 
J2)"^'^(q + x * (lg2 - ||q||)) is a series in x of type (exp(6/^), Blgj). 
Using Equation (12.32) we deduce that for x in P^Og^ , exp(— vr)) 



< exp(ei*)|x 



-^ 92(92-1) I ^(x) 

We set s = |x|oo and we assume that x takes the special form 



/ s 2s (oo — l)s 

X =-,-,..., ^-,s) (12.80) 

92 92 92 



and s < exp(— 7r). Then 



bookarxiv March 23, 2010 



310 CHAPTER 12 

, I / s g2(g2-i) 

We take 

s = io-'^4i" (12.81) 

where K4 is a large enough positive constant. Using Equations (12.78) and 
(12.77) we obtain the following lower bound for the quadratic Jacobian 

|JC^(q + x(l - g))| > exp(-e/i6) (12.82) 

when q, q, and x are given by Equations (12.78), (12.79), (12.80), and 
(12.81). In particular |q + x(l — q)\^ can be assumed to be < 1/2. So 



max 

qeD(0,l/2)92 



Jr''i<i) >expi-en. (12.83) 



In order to bound from below Jj^^'^ for any 7 G S we observe that if 
w is the width of the cusp 7(00), there exists a w-th root of unity and 
an algebraic number A^"^*^ of absolute value 1 (the product of all pseudo- 
eigenvalues) such that the following formal identity in C[[qi, . . . , qg]] holds 
true 

J7-'i(gi, . . . , fe) = XT'^J^^'^iC^qi, C^qg,). (12.84) 
So the lower bound in Equation (12.83) is also valid for every J^^^'^. 

12.7.3 Equivalence of norms on (Cusps) 

In Section 12.7.1 we have defined various norms on the space of quadratic 
differential forms (Cusps). If 

= f{q)q-\dqf 

is a quadratic differential form in H^(Cusps), the norm |a;|oo is the L°° 
norm associated with the basis Squad- For every 7 G S, the norm |a;|-y is 
defined by Equation (12.70). We write 

^ = f{q)q-\dqf = h{qy)q-\dqyf . 
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We must prove both inequahties in Equation (12.71). The first inequality is 
a trivial consequence of Equations (12.73) and (12.32). 
We denote by M.'^^ the matrix occurring in the definition of the jacobian 
So 



_fKqk)\ 

\ Qk / l<fe<S2,/l(«7)97^('i97)^eequad- 

In particular Jy^""^ is the determinant of M^"^^. 

Now let q, q and x be given by Equations (12.78), (12.79), (12.80), and 
(12.81). We set 

r = q + x(l - = (ri,r2, . . . ,rg,) G 0(0, 1/2)^^ 

and denote by M'^''^{r) the evaluation of M'^''^ at r. The entries 
in M^^^'^{r) are bounded above by Z® in absolute value. Using Equa- 
tion (12.82) we deduce that the entries in the inverse matrix of A1^"**^(r) 
are bounded in absolute value by exp(B/^^). 

Let w be a form in "H^ (Cusps) and let c € C^^ be the coordinate vectors 
of w = h{qj)q~^{dqyy in the basis ^Bquad- For every 1 < /c < 52 set 
Vk = h{rk)/rk and let v = . . . , Vg^) be the corresponding vector. We 
have 

V* = X^"^^(r) X c* 

where v* is the transposed vector of v and c* is the transposed vector of c. 
So 

|<^|oo = |c|oo < 52 exp(eZ^*') X |v|oo 

and this is < exp(9Z^^) x |a;|-y from the definition of |a;|-y given in Equa- 
tion (12.70). 



12.8 AN ELEMENTARY OPERATION IN THE JACOBIAN 

An important prerequisite for the expUcit computation in the Jacobian J is 
to be able to compute the hnear space associated with some divisor on X. 
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In this section, we describe an algorithm to solve the following elementary 
problem: given 3g — 4 points Pi, P2, -P35-4 in X{C), find g points Qi, 
. ..,Qg in X{C) such that 

Qi + • • • + - 2/C - (Pi + • • • + P3P-4) 

where ~ stands for linear equivalence of divisors and /C is the canonical 
class. This elementary problem will be used as a building block for exphcit 
arithmetic operations in the jacobian J of X. We observe that the solution 
is not always unique. However, the image of Qi + • • • + by the Jacobi 
integration map 0' : Sym^ X ^ J is well defined. When doing numerical 
approximations, it will be convenient to measure the error in J(C) = C/A 
in terms of the distance dj defined in Equation (12.9). 
We shall solve the above problem in two steps. We set 

P = Pi + • • • + P3P-4 

and we first look for a differential quadratic form cj in the hnear space 
V?{—P) C (Cusps) using our exphcit knowledge of the latter space 
and hnear algebra algorithms. We then compute the divisor (w) of w and 
output the (effective) difference (a;) — P. We now provide details for these 
two steps. 

We denote by T = P + Cusps the divisor obtained by adding the cusps 
to P. The degree of T is 52 - 1- We write T = Ti + + • • • + T^^-i 
where = {'yk,<lk) for every 1 < k < g2 — 1. Let ei = exp(— mi) be 
a positive real number. We assume that mi > @l. We find an ei-simple 

divisor T' = T{ + T^ + h T^^.i such that for every 1 < A; < - 1 we 

haveTj^ = (7it,9fc) and 

\q'k - qk\ < Q{92 - l)ei- 

We look for a quadratic form in 'H^(Cusps) having divisor > — Cusps+T'. 
The space of such forms can be described as the kernel of a matrix A4. Each 
of the 52 — 1 lines of M corresponds to a point for some 1 < k < g2 — l. 
The 52 columns of M correspond to the 52 forms in the basis ^Squad- The 
entry of M. at the hne corresponding to the point Tj, = (7^, q'f,) and column 
corresponding to the form oj in Bquad is obtained in the following way: we 
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consider the expansion of u in the variable g-y^, 

and we evaluate the function h{qj^)q~^ at the value q'j^ of q^^, corresponding 
to Tj^. The entries in At are bounded by Z® in absolute value according to 
Equations (12.56) and (12.32). 

We can't compute A4 exactly. Instead of that, we fix a positive real 
€2 = exp(— 7712) and we compute a matrix A4' with decimal entries in 
Z[i, 1/10] such that the difference M' - M has norm < 62. The en- 
tries in this matrix M' can be chosen to have numerators and denominators 
bounded in absolute value by exp(6(Z + m2)). We find a non-zero vector in 
the kernel of M', having coefficients in Z[i] and bounded in absolute value 
by exp(0Z^(Z + 771,2)). We divide this vector by its largest coefficient an ob- 
tain a vector v = {vk)i<k<g2 with L°° norm equal to 1. This vector may not 
lie in the kernel of Ai but Mv has coefficients bounded by (72 exp(— ?7t,2)- 
We call V the quadratic differential form in (Cusps) having coordinate 
vector V in the basis i3quad- By definition we have 

= 1 (12.85) 

Using Lemma 5.4.12 of Chapter 5 together with Equations (12.71) and 
(12.85) we show that if m2 > /®, then for every 1 < < 52 — 1 the 
form V has a zero T'^ = (7^, g^') such that 

kit - <ik\ < exp(-e"^V^)- 

If m2 > Qm\ then these 52 — 1 zeros must be pairwise distinct, because 
each of them is close to some and the latter points form an ei-simple 
divisor. The divisor of u can be written 

(i/) = T" - Cusps + Q' 

where T" = Ylii<k<g2-i '^k ^^'^ ^ degree g effective divisor. We 
rewrite {u) as 

{v) = p + Q'+ Yl ir'^-Tk). 

I<fc<92-1 

The image of the error term '^Kk<g2-i (-^fc ~ '^k) by ^' is small in the 
torus J(C) = C/Tl. More precisely 
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dj{0,cf>'{ J2 {Tl!-Tk)))<eM-mi/e) 

l<fc<92-l 

provided mi > Z® and m2 > mf. 

So Q' is a good approximation for the solution Q to the original problem. 
Using the algorithm in Theorem 5.4.3 of Chapter 5, we compute an approx- 
imation of the divisor of v and output the corresponding approximation Q" 
ofQ'. 

12.8.1 Lemma (An elementary operation) There is a deterministic algo- 
rithm that on input a degree Sg — A effective divisor P = Pi-\ + Psg-A 

on Xi{5l), returns a degree g effective divisor Q = Qi-\ \-Qg such that 

Ql + • • • + ~ 2/C - (Pi + • • • + Psg-4) 

where K. is the canonical class on Xi (51). The running time is {Im)^ where 
51 is the level and m the required absolute accuracy of the result. 

Remind that the accuracy of the result in the above statement is measured 
in the torus C/A using the distance dj introduced in Equation (12.9). 

12.9 ARITHMETIC OPERATIONS IN THE JACOBIAN 

We fix a degree g effective divisor 17 on X. We also need an effective degree 
g — 4: auxiliary divisor 11. For example, we may choose a point O as origin 
for the Jacobi integration map (e.g. O could be the cusp at infinity), and set 
CI = gO and H = {g — 4)0. An element in Pic°(X) is given as the class of 
a divisor Q — CI where Q is a degree g effective divisor. Let R be another 
degree g effective divisor. In order to add the class of Q — fl and the class 
of R — Cl we apply Lemma 12.8.1 twice. We first apply it to the divisor 
Q + R + 11. This is indeed a degree 3g — 4 effective divisor. We obtain a 
degree g effective divisor T such that T 2K. — Q — R — H. We again apply 
Lemma 12.8.1 to the divisor T + Q + IT this time. And we obtain a degree 
g effective divisor U such that J7 + J7 ~ Q + i?. So the class of U — CI is 
the sum of the classes ofQ — Cl and R — CI. 
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In order to compute the opposite of the class Q — Q., we apply 
Lemma 12.8.1 to the divisor 20 + 11 and obtain a degree g effective di- 
visor R, linearly equivalent to 2/C — 11 — 2Vt. We apply Lemma 12.8.1 to 
the divisor R + Q + Xl and obtain a degree g effective divisor T such that 
T-rt (Q-0). 

12.9.1 Theorem (Arithmetic operations in Ji(5Z)) Addition and subtrac- 
tion in the jacobian of Xi{bl) can be computed in deterministic time (Im)^ 
where 51 is the level and m the required absolute accuracy of the result. 

Again, the accuracy of the result is measured in the torus C/A using the 
distance dj introduced in Equation (12.9). In particular the error belongs to 
a group, and when chaining operations in the jacobian, the successive errors 
add to each other: the error on the result is the sum of the errors on either 
input plus the error introduced in the current calculation. This observation 
is particularly useful in conjunction with the fast exponentiation algorithm 
of Section 5.1: if we multiply a divisor Q — J7 by a positive integer N, 
assuming that every elementary operation introduces and error < e, then the 
error on the final result is < B x e x iV log N so the loss of accuracy is 
< eiogA^. 

12.9.2 Theorem (Fast exponentiation in Ji{5l)) There is a deterministic 
algorithm that on input two degree g effective divisors J7 and Q on Xi{5l) 
and a positive integer N outputs a degree g effective divisor R such that 

R-n^ N{Q -n). 

The algorithm runs in time {Im log iV)® where hi is the level and m the 
required absolute accuracy of the result. 



12.10 THE INVERSE JACOBI PROBLEM 

In this section we are given a degree g effective origin divisor Q on X and 
an element x in C^dr, and we want to solve the inverse Jacobi problem for 

x + Ae C^dr/a = J(C). 
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So we look for a degree g effective divisor P = Pi + ■■■ + Pg on X such 
that (j)'{P — ^) = X + A. We note that the solution might not be unique. 

The main idea is the following: we start from a family of 2^ classes 
6i + A, 62 + A, . . . , 62s + A in J for which the inverse Jacobi problem is 
already solved: for every 1 < k < 2g, v/e know a divisor Bj; — Q, such that 
4>'{Bk — = 6fc + A. We try to approximate x by an integer combination 
J2i<k<2g ^kbk- This should not be too difficult if the are very small and 
R-linearly independent: we compute the coordinates of a; G in the M- 
basis made of the and we round each of these coordinates to the closest 
integer. Once we have found the we note that the divisor Ylik^kBu 
would be a nice solution to the problem if it were a difference between 
two effective degree g divisors. This is not the case of course, but using 
the algorithms in Theorems 12.9.2 and 12.9.1 we find a degree g effective 
divisor P such that P — O is hnearly equivalent to N^Bk. We output P 
and we are done. 

There remains to explain how to find the b^ and the corresponding Bj.. 
For every 1 < k < 2g, we set B^ = R'j^ — where Rk and R'^, are two 
points on X that are very close. More precisely, we choose the g first points 
Rk = ilk^Qk) foT 1 < k < g, and we set Rk+g = Rk- We also choose a 
positive integer T = exp(— x). We assume that x > Z® so T is small. For 
l<k<g,v/e set i?^ = (7^, Qk + T) and = (7^, Qk + ^T). We set 



These integrals can be computed efficiently using the same method as for 
period integrals. We now want to quantify the condition that these bk should 
be R-hnearly independent. So let {ek)i<k<g be the canonical basis of O 
and set ek+g = ick tor I < k < g. So {ek)i<k<2g is a basis of the M-vector 
space underlying C^. We shall need a lower bound for the determinant 



Since T is going to be small, we derive such a lower bound from the local 
study of the Jacobi integration map. We call 7 G the vector {'yk)i<k<g 




61 A ■ ■ ■ A 623 
ei A . . . A e2p 



(12.86) 
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and we call 



(f);^ : D{(}, ly c/n 

the composition of the Jacobi map (p : with the product of the 

modular parameterizations 

For every 1 < k < g we set = it;^^. Let q = {qi, ■ ■ ■ , Qg) with 
qk G Z)(0, cxp(— vr/tijfe)) for every I < k < g. We study the map (j)^ 
locally at q. The tangent space to D{0, ly C at q is identified with 
and we denote by {Sk)i<k<g its canonical basis. The underlying M- vector 
space has basis {Si, . . . ,Sg,iSi, . . . , idg). For 1 < A; < 5 we set Sk+g = iSk- 
Let Dqcf)^ be the differential of 0^ at q. For 1 < A; < 2^ let pk be the image 
of Sk by this differential. Assuming x '® using Equations (12.56) 
and (12.32) we prove that the coefficients of pk in the basis {em)i<m<2g 
have absolute value 

< /®. (12.87) 

The determinant of -Dq0-^ 

plA...Ap2g 

ei A ... A 623 

is the square of the absolute value of the Jacobian determinant 



UJ 



dq. 



Ik 



(12.88) 



We denote A the opposite of the logarithm of the absolute value of the 
above determinant, and we call it the illconditioning of q. We shall see that 
the inverse Jacobi problem is well conditioned unless the illconditioning is 
large. 

We first observe that we can bound from below the norm of every p^ in 
terms of A. Indeed, the determinant of Dc^<t>^ is bounded from above by the 
product of the norms ni<fe<2g \pk\2 so 
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exp(-2A) < \pk\2 X Yl \Pjh < |pfe|2 X exp(e/^) 

using Equation (12.87). So 

\Pk\2 > exp(-2A - (12.89) 

Our next concern is to bound from below the determinant of Equa- 
tion (12.86) in terms of the illconditioning A. For every 1 < k < 2g we 
notice that Tp^ is the first order approximation of bk- We deduce from 
Equations (12.56) and (12.32) that 

\bk - Tpk\ < /®T2. 

Using the lower bound (12.89) we deduce that 

^\Pk\2<\bk\2<^\pk\2<l^T 

provided x ^ + 2A. 

Using multilinearity of the determinant we can bound the difference 

fel A . . ■ A fc2g _ Pi A ■ ■ ■ A /92g 

ei A . . . A e2g ei A . . . A 

by 

/ \ 2g-l 

29 I max \bk\2] max \bk - TpkU < 29fi(^9-i)ie^2g+i 

and this is less than half of T^s | | = exp(-2A)T29 as soon as 

X > e/^ + 2A. 

We deduce that 

61 A • • • A 62s - 1 



> -exp(-2A-25x)• 
el A • • • A 623 2 

So we have a lower bound for the determinant of the transition matrix 
between the basis {ek)i<k<2g and the basis {bk)i<k<2g- Further the entries 
in this matrix are bounded by Z®T in absolute value. Therefore the entries 
in the inverse matrix are bounded by 
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2exp(2A + 2gx)l^^T^^~^ < exp(2A + x + 01^) 

in absolute value. We thus can compute this inverse matrix in time polyno- 
mial in Z, A, X and the required absolute accuracy. 

In Section 12.2 we have constructed a basis Bper for the lattice of peri- 
ods, consisting of vectors with coordinates bounded by exp(/®) in absolute 
value in the basis {ek)i<k<2g- The coordinates of these periods in the basis 
{h)i<k<2g are bounded by 

exp(Z® + 2A + x) 

in absolute value. 

Every point in the fundamental parallelogram associated with the ba- 
sis BpcT (i-e. having coordinates in [0, 1] in this basis) has coordinates 
< exp(2A + X + iri absolute value in the basis {bk)i<k<2g- When 
we replace the latter coordinates by the closest integer, the induced er- 
ror is bounded by Z®T according to the norm for the canonical basis 
(efe)i<fc<2s- 

According to Equation (12.67) there exists a vector q with illconditioning 

A<Z®. 

This finishes the proof of the following theorem. 

12.10.1 Theorem (Inverse Jacob! problem) The exists a detemiinistic al- 
gorithm that takes as input 

• a prime integer I, 

• an element x in the tangent space C^dr to Ji (51) at the origin (where 
B^^^ is the basis of -ff^R f^^de of normalized newforms of level 51 
together with normahzed newforms of level I lifted to level 51 by the 
two degeneracy maps), 

• a degree g effective (origin) divisor Q, on Xi{5l), 

and returns an approximation of the degree g effective divisor 
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on Xi{5l) such that (p'{P - = x + A. 

The ruaaiag time is {I x log (2 + \x\^) x m)® where 51 is the level, m 
is the required absolute accuracy of the result and log {2 + \x\^) is the size 
of X i.e. the logarithm of its L°° norm in the canonical basis of C^dr. 

We insist that the absolute accuracy in the above theorem is measured 
in the space C^dr using the norm; or equivalently in the jacobian 
J = Ji{5l) using the distance dj. However, when x belongs to the Ra- 
manujan subspace Wf and assuming the degree g origin divisor CI is the 
cuspidal divisor Dq manufactured in Section 8.1, then there is a unique ef- 
fective degree g divisor Q such that 4>'{Q — Q) = x + A. We call it the 
Ramanujan divisor associated with x. In that case, we can and must con- 
trol the error in X^. This error can be expressed as the distance between 
Q = J2i<k<gQk and the output divisor Q' = J2i<k<gQ'k- Assume that 
Qk = {ikjik)- The distance between Q and Q' is defined to be the mini- 
mum over all permutations cr of {1, 2, . . . , g} of the quantity 



max 

i<ifc<ff 



Qk-qjkiQ'a~ 



Sections 12.1 1 to 12.13 will be mainly devoted to the proof of the theorem 
below. 



12.10.2 Theorem (Approximating Vf over the complex numbers) 

There exists a deterministic algorithm that takes as input an even integer 
k > 2, a prime integer I > 6{k — 1), a finite field F with characteristic I, 
a ring epimorphism f : T(l, k) F, and a cuspidal divisor on Xi{5l) 
like the divisor Do constructed in Section 8.1, and computes complex 
approximations for every element in Wf C Ji(5Z), the image of Vf C Ji{l) 
by I ^. Here Vf C Ji{l) is defined by Equation (12.1) and we assume 
that the image of the Galois representation pf associated with f contains 
SL(Vf ). The algorithm returns for every element x in Wf a complex 
approximation of the unique degree g divisor Qx = l^i<„<g Qx,n such 
that Qx — ^ lies in the class represented by x. Every point Qx,n is given as 
a couple (7, q) where 7 G H and q is an approximation of the value at Qx,n 
of the local analytic parameter q^ defined by Equation (12.2). The running 
time of the algorithm is < (mx^Vf)^ for some absolute constant 6. Here 
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#V/ is the cardinality of the Galois representation Vj and m is the required 
absolute accuracy of the returned approximations for the q associated with 
every Q^^^- 

There are two important differences between Theorem 12.10.1 and The- 
orem 12.10.2. While Theorem 12.10.1 controls the error in Ji(5/), Theo- 
rem 12.10.2 controls the error in Xi{5iy. Unfortunately, Theorem 12.10.2 
only applies to special divisors like the Qx — ^- For these divisors, one 
can prove that the inverse Jacobi problem is reasonably well conditioned. 
Results in Section 8.1 prove that Qx is well defined; and using Proposi- 
tion 11.7.1 in Section 11.7 one can show that computing Qx from x is a 
well conditioned problem. This will be the purpose of the next three sec- 
tions. 

Another remark concerning notation. We denote by 17 the divisor Dq 
introduced in section 8.1. And we write Qx rather than Dx- The only reason 
for this slight change in notation is that many things are akeady called D in 
this chapter, and we want to avoid any possible confusion. 

12.11 THE ALGEBRAIC CONDITIONING 

An important feature of Theorems (12.9.1), (12.9.2), and (12.10.1) is that 
the error in all these statements is measured in the torus J(C). We have 
seen that this helps controlling the accumulation of errors when we chain 
computations. However, when solving the inverse Jacobi problem, we want 
to control the error in Sym^ X, at least for the final result of the computa- 
tion. So we need a theoretical estimate for the error in Sym^ X in terms of 
the error in J(C). This will be the main concern of this and the following 
two sections. 

So assume that we are given a degree g effective origin divisor J7 on X 
and a vector x in C^DR, and we look for an effective degree g divisor P such 
that (f)'{P — n) = X + A, where A is the lattice of periods. We write 

P = mPi + 712^2 + • • • + ukPk (12.90) 

where the {Pk)i<k<K are pairwise distinct points on X and the {nk)i<k<K 
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are positive integers such that 



ni + 7X2 H \-nK = g- 



We shall make two assumptions. 

The first assumption is rather essential: we assume that the divisor P is 
non-special or equivalently that : 



A first interresting consequence of this first assumption is that the answer 
to the inverse Jacobi problem is unique; and the error can be defined as the 
distance to the unique solution. 

The second assumption we make is more technical. We assume that 
Klein's modular fonction j does not take the values or 1728 at any of 
the points {Pk)i<k<K- So 



Removing the second assumption would only result in an heavier presen- 
tation. By contrast, the first assumption plays a crucial role in the forthcom- 
ing calculations. Its meaning is that the Jacobi map (j)' : Sym^ X ^ J is 
a local diffeomorphism at P — Q. Our first task is to reformulate this first 
assumption in a more algebraic setting. We look for an algebraic variant of 
the Jacobi determinant in Equation (12.88). Knowing that such an algebraic 
quantity is non-zero we will bound it from below in Section 12.12. 

We assume that we are given a basis of H^j^{Xi{5l)) such that for 
every co = f{q)q~^dq in B^, the associated modular form /(g) has rational 
integer coefficients and type (exp(G/'^), O). The existence of such a basis 
is granted by Lemma 12.11.1 below. We stress that we don't try to compute 
such a basis. We are just happy to know that it exists. 

We also need an algebraic uniformizing parameter tg at every point Q on 
X such that j((5) ^ {0, 1728}. When Q is not a cusp either, the differential 
dj of Klein's function j has no pole nor zero at Q. So j — j (Q) is a uniformiz- 
ing parameter at Q. So we set tg = j — j{Q) in that case. When Q = 7(00) 
is a cusp and 7 G S, we set 



dim(A(P)) = 1. 



(12.91) 



j(Pfe) {0,1728}. 



j - j o W, 



r-l 
7 
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where Wy is given in Equation (12.7). We deduce from Equation (12.8) 
that the automorphism W:^'^ maps the cusp 7(00) to the cusp 00. So has 
a simple pole at 7(00) and is a uniformizing parameter at 7(00). So 
we set tq = in that case. We notice that j-y only depends on the width 
of 7(00). We call ji = j, j5, ji and j^i the four corresponding functions. 
AUtogether, tg is one of the following functions: j — }{Q), 1/j, l/js, or 

l/j5/- 

Let ubea. form in and let k be an integer such that 1 < k < K where 
K is the number of distinct points in the divisor P of Equation (12.90). Let 
tk = tpi, he the algebraic uniformizing parameter at Pk and consider the 
Taylor expansion of 00/dtk at Pk 

'^Mfc=efc^O+«fc^ X -^+^k,2 X ^ + -+4"n,-l X )• (12.92) 

We only need the first terms in this expansion, where Uk is the multi- 
plicity of Pfe in the divisor P. We form the matrix 

Mp^ = {^k,rn)i^k<K,0<m<nk-l;uieBl. (12.93) 

The lines in TWp^ are indexed by pairs {k,m) where 1 < k < K and 
< m < nfe — 1. The columns in TWp^ are indexed by forms u in B\. 
We call Mp the ahebraic Wronskian matrix at P. The determinant of 
A^p^ will play an important role in the sequel. We call it the algebraic 
conditioning. 

An important feature of the matrix M^p" is that its entries are alge- 
braic functions evaluated at the points -P/t for 1 < A; < K. Indeed let 
tk = tp^ G {j - ]{Pk), 1/15, l/isj be the chosen algebraic uni- 
formizing parameter at the point P^ and set a;^*^) = ui/dtk- For every integer 

m > seta;(™+i) = dio^"''> /dtk- Then 

4% = a;(-)(P,). 

Lemma 12.11.2 below provides more detailed information about the al- 
gebraic dependency between the derivatives ui^'^^ and Klein's function j. 

It is an important consequence of our first assumption in Equation (12.91) 
that the determinant of the algebraic Wronskian matrix is non-zero 

det^tp^ 7^ 0. 
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In the next Section 12.12 we shall derive a lower bound for this deter- 
minant, using the theory of heights. To finish this section, there remains to 
state and prove the two Lemmas 12.11.1 and 12.11.2. We first construct the 
basis B^. 

12.11.1 Lemma (A rational basis) There is a basis B\ of H^^{Xi{5l)) 
such that for every u = f{q)q~^dq in B\, the associated modular form 
f{q) has rational integer coefficients and type 

(exp(ei4),e). 

The transition matrix from the basis B^y^i to the basis B\ has algebraic in- 
teger entries bounded in absolute value by exp(0Z^) and its determinant is 
the square root of a non-zero rational integer. 

We construct B^ from B^^ using a descent process. 
Let a; be a differential form in the basis B^^^ and let 

f{q)=ooq{dq)-^ = J2fjq' 

i>i 

be the corresponding modular form. Let be the ring generated by the 
coefficients of f{q). As a Z-module, is generated by the fj for j < 4/^. 
Let be the fraction field of Zj. Let L be a strict subfield of Kj. Let 
a = (aj)i<j<4;2 be a vector with rational integer coefficients. The asso- 
ciated Unear combination J2i<j<4p ^^jfj belongs to L if and only if a be- 
longs to a submodule of Z^'^ with rank < 4Z^. The degree df of Kf over Q 
is bounded above by 2g. So the number of strict subfields of is < 2^^. 
So there exists rational integers (aj)i<y<4p such that < aj < 2^^ and 
9 = J2i<j<4i2 ^jfj does not belong to any strict subfield of Kf. This 9 is 
an algebraic integer that generates Kf over Q. For < < d/ — 1 we set 

i>i 

where Tr : Zj — Z is the trace map. Since \fj\ < 0(j + 1)® and 
1^1 < exp(e/2) we deduce that \Tr{e''fj)\ < exp(e/^)(j + 1)®. So the 
series Tr(6l'^7) for < A; < cZ/ - 1 have type (exp(G/^), G). 

We do the same construction for every Galois orbit in B^^^. We collect all 
the forms thus obtained. This makes a basis B^ of Hjy^{Xi{5l)) consisting 
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of forms f{q)q^^dq where f{q) is a series with integer coefficients and of 
type (exp(G/'^),e). □ 

Now let's prove some quantitative statement about the algebraic depen- 
dency between the successive derivatives u^'^^ and j. 

12.11.2 Lemma (An algebraic relation) Let t be one of the functions 
j, l/}5, l/ji, l/}5i. Let uj he a form in B\ and let m > Q he an inte- 
ger. Setuj^^") = oj/dt andtj(™) = d"" {dt)'^ . There exists a non-zero 
irreducihle polynomial E{X, Y) G Z[X, Y] such that 

Its degree in either variable is 

< {Imf, 

and its coefficients are hounded in absolute value hy 

exp((/m)®). 

All the functions involved belong to the field Q{Xi (51)) of modular func- 
tions having Puiseux expansion in Q{{g}} at the cusp oo. This field is a 
regular extension of Q(j) corresponding to the standard model of Xi{5l) 
over Q. 

We assume that t = j since the other cases are quite similar. The dif- 
ferential dj has 4:{P — 1) zeros of multiplicity 2 (the points in the fiber 
of j above 0) and Q{1^ - 1) zeros of multiplicity 1 (the points in the fiber 
of j above 1728). So uj^°^ = u/d) has degree < 14/^ and less than lOZ^ 
poles. When we differentiate u^^^ we increase by one the multiplicity of 
each pole. So dou^^^ has the same poles as cu^^^ and the total multiplic- 
ity of these poles is less than 24/^. When we divide by d,j we don't add 
poles but we increase the multiplicities by 1 (in the fiber of j above 1728) 
or 2 (in the fiber of j above 0). The degree of the polar divisor of u)^^^ is 
thus < 38/^. We go on like that and we prove that the degree of w^™) is 
< (14 + 24m)P < 24(m + The degree of j is 12(^2 - 1). So there 
is an irreducible polynomial E{x, y) in Z[x, y] such that E{uj^'^^ , }~^) = 
and deg^ E < 12{l^ - 1) and degj, E < 24(m + 1)/^. 
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In order to bound the coefficients in E(x, y) we consider the expansions 
of and w'^"*) at the cusp oo. Remember that 



k>l 

so 

^ k>l 

From Equation (12.5) we deduce that J2k>i kc{k)q^ has exp-type (0, 0, 2) 
in the sense of Section 12.4.12. Using Equation (12.39) we deduce that 
(~^^^) exp-type (/«i,0, 4) where ki > 1 is an absolute constant. 

We write 

) =-q l-q 

aq \ aq 

The series uj/dq has type (exp(6/'^), 6) and exp-type (6,0/^,2). Using 
Equation (12.37) we deduce that oj^^^ has exp-type {K2,pKs,'i) for some 
absolute constants K2 > 1 and K3 > 1. A simple iteration shows that w^"*) 
has exp-type 

, ,2 m(m — 1) „ ,x 
{k2 + rriKi^l K3 + mK2 H + 2m, 4). 

So if a is an integer such that < a < 12{P — 1) then (oj*^™))" has 
exp-type 

{ef{m + l),ef{l + m + 1)2,4). 

On the other hand, has exp-type (0, 0, 4) and if 6 is an integer such 
that < 6 < 24(m -I- 1)P then j-^ has exp-type 

(0(m + l)^^0(m + l)/^4). 

So all the monomials (u^"^'>Y arising in equation E(a;("*\ j~^) = 
have exp-type 

{ef{m + + m + l)^ 4) 
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and the coefficients in their g-expansions up to order 
deg(a;("')) x deg(j-^) < e(m + 
are rational integers bounded in absolute value by 

exp(eP(m + l)«). 

Since the coefficients in E{x, y) are solutions of the homogeneous system 
given by these truncated g-expansions, they are bounded in absolute value 
by 

exp(ez28(m + lf). 

□ 

12.12 HEIGHTS 

In this section we recall basis facts about heights of algebraic numbers and 
we deduce upper and lower bounds for the determinant of the algebraic 
Wronskian matrix in Equation (12.93) when the divisor P is a Ramanujan 
divisor. 

Let Q C C be the algebraic closure of Q in C. Let a G Q be an algebraic 
number. The degree da of a is the degree of the field extension Q(a)/Q. 
Let 

f{x) = aa^x'^" + Ud^-ix'^"-^ + ■ ■ ■ + ao 

be the unique irreducible polynomial in Z[x] such that /(a) = and 
O'da > 0- We say that a^^ is the denominator of a and we denote it da- 

Let IK be a number field containing a. The multiphcative height of a with 
respect to K is 

HK{a) = JJ max(l, |o-(q;)|) JJ max(l, |a|^) 

where the a in the first product runs over the set of embeddings of IK into 
C and the v in the second product runs over the non-archimedean places of 
K. In the special case K = Q(a) we have 

l<fe<<ia 
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where the are the da roots of f{x). 

The logarithmic height of a with respect to K is 



= logFK(Q;) 



and the absolute (logarithmic) height of a is 



h{a) = 



deg(K/Q) 




Knowing the degree da and absolute height h{a) of a non-zero algebraic 
number a, we deduce the following upper and lower bounds for the absolute 
value \a\ 



Let F{x) be a degree dp polynomial in Z[x] and assume that all coeffi- 
cients in F{x) are bounded by Hp in absolute value. Let K be a number 
field and let a € K be an algebraic number. We set j3 = F{a). 

If a is any embedding of IK into C we have cr(/3) = F{a{a)) so 

max(l, \a{/3)\) < {dp + l)i?Fmax(l, \a{a)\Y'' . 

Now, let u be a non-archimedean valuation of K. We have 

max(l, \P\v) < max(l, |q;|„)'^^. 

Forming the product over all a's and all v's we find that the absolute 
logarithmic height of /3 is 



Now assume that a and /3 belong to a degree d extension IK of Q and let 
E{x, y) G Z[x, y] be a polynomial such that E{a, y) / and £'(q, /3) = 0. 
Assume that all coefficients in E{x, y) are bounded by Hp in absolute value. 
Call dx (resp. dy) the degree of -^(a::, y) with respect to the variable x (resp. 



exp {—da X h{a)) < \a\ < exp [da x /i(q;)) . 



< dp X h{a) + log((iF + 1) + log Hp. 



(12.94) 



We write 



E{x,y)= Ek{x)y\ 

0<k<dy 
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We deduce from inequality (12.94) that every Ek{a) has absolute height 

< X h{a) + \og{d^ + 1) + log He. (12.95) 
Let K be the largest k such that Ek{a) ^ 0. Set 

Fiy) = E{a,y)= ^ ^fc(a)/. 

0<k<K 

If a is any embedding of K into C we call 

''F{y) = E{a{a),y) = ^ ^^^(^(a))/ 
o<fe<Js: 

the polynomial obtained by applying a to all the coefficients in F[y). Ap- 
plying Landau's inequaUty to ^F{y) we find that 

max 1, < . . xx, 

and this is 

< ^/d^l^ X (da; + 1)He X max(l, |o-(a)|)'^" x max(l, |£;i^(<T(Q;))|"^). 

Now, let vhea non-archimedean valuation of IK. Applying Gauss' lemma 
to F{y) we find that 

max(l, \l3\y) < \EKia)\~^ x max(l, 

<max(l, \EK{a)\~'^) x max(l, 

Forming the product over all cr's and all v's we find that the absolute 
logarithmic height of P is bounded from above by 



^"^^"^^^^^ + log(d. + 1) + logiJi, + d, x h{a) + h{EK{a)). 
Using Equation (12.95) we deduce that 



HP) < ^"g^"^^ + ^) + 21og(d^ + 1) + 21ogi7£ + 2d,; X h{a). 
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12.12.1 Lemma (Relating heights of algebraic numbers) Let a and j3 

belong to a degree d extension of Q and let E{x, y) G 'L[x, y] be a polyno- 
mial such that E{a, y) and E{a, (3) = 0. Assume that ail coefficients 
in E{x, y) are bounded by He in absolute value. Call dx (resp. dy) the 
degree of E{x, y) with respect to the variable x (resp. y). Then the absolute 
heights of a and (5 are related by the following inequality 



We now can bound the heights of the entries in the algebraic Wronskian 
of Section 12.11, at least in the cases we are interrested in. Let 



be a non-zero vector in the Ramanujan subspace Wf of Theorem 12.10.2. 
Assume that the degree g origin divisor on Xi{hl) is the cuspidal divisor 
-Do manufactured in Section 8.1. Let P be the unique degree g divisor such 
that 



As proven in Section 8.1, the two assumptions of Section 12.11 are sat- 
isfied in that case: the divisor P = n\Pi + 712^2 + • • • + ukPr is non- 
special and Klein's modular fonction j does not take the values or 1728 
at any of the points {Pk)i<k<K- Proposition 11.7.1 in Section 11.7 im- 
plies that the absolute height of every j(Pfe) is < Z®- Using Lemma 12.11.2 
and Lemma 12.12.1 we deduce that every entry in the algebraic Wronskian 
matrix of Equation (12.93) has absolute height < /®. Further any such en- 
try generates an extension of Q of degree < {#Vf)®. So every entry in 
the algebraic Wronskian has denominator and absolute value bounded by 
exp((#V/)®). So both the denominator and absolute value of the determi- 
nant are < exp((#V7)®). So 



h{/3)< 



lOgjdy + 1) 

2 



21og(4 + 1) + 2\og He + 2dx x h{a). 



x + AeWfC J(C) = C^DR 



/A 



(P'{p-n) = x + A. 



/i(det(7W^S)) < iWf) 



e 



(12.96) 



in that case. 
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Note also that, as an algebraic integer, the algebraic conditioning as de- 
gree at most twice #V/ because the square of it lies in the definition field of 
a; + A and the latter field is a degree #F/ — 1 extension of Q. 

We deduce that for all primes p but a finite number bounded by (#V/)®, 
the divisor P remains non-special when we reduce modulo any place p 
above p. Indeed, we can assume that p ^ {5, 1} so Xi(5/) has good re- 
duction modulo p. We also can assume that ]{Pk) {0, 1728} mod p be- 
cause both the degree and the absolute height of ]{Pi) are < (^Vj)®. We 
also can assume that the Pk remain pairwise distinct modulo p for the same 
reason: we just need to exclude less than (#1^/)® primes p. We can also 
assume that every P^ which is not a cusp does not reduce modulo p onto 
a cusp. We also assume that p is larger than the genus g of Xi(5Z) so that 
the Taylor expansion in Equation (12.92) remains vaUd modulo p. So the 
algebraic Wronskian matrix reduces modulo p to the algebraic Wronskian 
matrix. Excluding a few more primes, but no more than {^Vj)^ , we can 
assume that the algebraic conditioning does not vanish modulo p. So the 
divisor P remains non-special. 

12.12.2 Lemma (Reduction modulo p of a Ramanujan divisor) Call Q. 
the cuspidal divisor Dq on Xi{5l) introduced in Section 8.1 and let Wf 
be the Ramanujan subspace Wf of Theorem 12.10.2. Let 

xeWfC Ji(5/) 

and let P be the unique divisor on Xi {51) such that P — Hes in the class 
defined by x. Then P is non-special and for all primes p but a finite number 
bounded by (#1^/)®, the divisor P remains non-special modulo any place 
p above p. 

We stress that the above lemma is very similar to Theorem 1 1.7.10. 
12.13 BOUNDING THE ERROR IN X9 

In this section we fill the gap between Theorems 12.10.1 and 12.10.2. For 
X + A G Wf C J(C) and P the corresponding Ramanujan divisor, we 
relate the error on P and the error on x. We need some control on the Ja- 
cobi integration map locally at P. A first step in this direction is the upper 
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bound for the height of the algebraic stabiUty, given in Equation (12.96). 
In Section 12.13.1 we deduce a lower bound for the determinant of the dif- 
ferential of the Jacobi map at P. This bound impUes that the Jacobi map 
is non-singular on a reasonably large neighborhood of P, as we show in 
Section 12.13.3. In Section 12.13.4 we deduce that the inverse of the Ja- 
cobi map is well defined and Lipschitz (with reasonably small constant) on 
a (reasonably large) neighborhood of a; + A. We shall need the identities 
between Wronskians and Jacobians of power series proven in Section 12.5. 
The reason for these algebraic complications is the following: we need an 
equation for the singular locus in of the Jacobi integration map. The 
space is stratified by the diagonals. The strata correspond to partitions 
of {1, 2, 3, ... , g}. We obtain a different equation for the singular locus on 
every stratum. These various equations are related by algebraic identities 
between Jacobians and Wronskians. 

12.13.1 The analytic conditioning of a divisor 
Let 

P = mPi + ■■■+ ukPk (12.97) 

be a degree g effective divisor on X where the are positive integers for 
\ <k < K. For every k we write 

Pk = {ik,qk) 

where 7fc G H and qk G ^ -D(0, exp(— 7r/if;fe)), where Wk is the width 
of the cusp 7fc(oo). Let 

hn,),<u<K-- n Sym-'^ X ^ J(C) = C^BK/A 

l<k<K 

be the relevant Jacobi integration map in this context. We stress that this 
map is different from the maps introduced before. Its initial set is a sort of 
semi-symmetric product i.e. something between the Cartesian product X^ 
and the full symmetric product Sym^ X. In order to write down the differ- 
ential of this map at the divisor P, we need a local system of coordinates on 
ni<jfc</^ Sym"'^ X. We shall use partial Newton power sums. Let 
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be a point on X. For every n > 1 and m > 1 we define the m-th power 
sum VR^n.m on Sym" X to be the function that takes the value 

(g^(Qi) - q^{R)r + {q^m - q^{R)r + ■■■ + (QiiQn) - q^{R)r 
at {Qi,. .. ,Qn}. 

Now let us come back to the divisor P in Equation (12.97). The functions 

{^Pk,nk,m)l<k<K;l<m<rn. 

form a local system of coordinates on ni<fe<A' Sym"*^ X at the divisor P. 
The matrix of the differential at P of the integration map 4'{nk)i<k<K 
bases idiyp^^,nk,m)i<k<K;i<m<nk and ^3l,J^^is 

= n ^ ^ (^^%)l<.<K;0<^<n,-l (12.98) 

lll<fe<i<: lll<m<nfc - 

where is the m-th derivative of oj/dq^^, with respect to q-y^,, evaluated 
at Pk = (7fc, qk)- The determinant of this matrix is called the analytic con- 
ditioning of the divisor P. This analytic conditioning and the algebraic con- 
ditioning defined in Section 12.11 after Equation (12.93) differ by simple 
factors we should not be afraid of. 

Now, we assume that we are in the context of Theorem 12.10.2. We call 
the cuspidal divisor Do constructed in Section 8.1 and we assume that 
the class of P — $7 corresponds to a point x in the Ramanujan subspace 
Wf C J. Equation (12.96) implies that the algebraic conditioning of P is 
> exp(— (#V/)®). In order to obtain a similar lower bound for the analytic 
conditioning, we must bound from below the complementary factors. 

The factor l/ni<fc<xni<m<«,. is > cxp(-e/^). 

Lemma 12.11.1 implies that the factor coming from the change of bases 
from B^p^ to is > cxp(— /®). 

There are also factors due to the change of coordinates. Assume for ex- 
ample that Pk is not a cusp. So the algebraic parameter at is j — j(Pfc). 
The analytic parameter at Pk is q-y^, — qk- The extra factor in the analytic 
conditioning is thus 



dq. 



Ik 
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Lemma 12.13.2 below ensures that there exists a constant Ki such that this 
factor is > exp(— (#V/)^i) provided there exists a constant K2 such that 
and \j{Pk) - 1728| are both > exp(-(#V7)^2) But this latter con- 
dition is met because }{Pk) is not {0, 1728}, and both its degree and loga- 
rithmic height are < (#V/)®. 

Assume now that Pk is a cusp. Then the algebraic parameter at P is the 
function l/}w^. introduced in Section 12.11 where wi. G {1,5,1,51} is the 
width of the cusp Pj^ = 7fc(oo). And the derivative d{l/]yj^) / dq^^^ is just 1. 
So the analytic conditioning at a Ramanujan /-torsion divisor is 

> exp(-(#F/)®). (12.99) 



To finish this section, there remains to state and prove Lemma 12.13.2. 

12.13.2 Lemma (Lower bounds for di / dx) For every positive real num- 
ber K\ there exists a positive real number K2 such that the following state- 
ment is true. 

Let L > 2 be an integer and let J(,t) be Klein's series given in Equa- 
tion (12.3). Let q G D{0,1) be a complex number in the unit disk such that 
l-\q\ > L-^i and|J(g)| > exp(-L^i) and |J(g)-1728| > exp(-L^i). 
Then If > exp(-L^2). 

We first note that f (g) only vanishes if 3(q) G {0, 1728}. So we just 
want to prove that if f is small at q then q is close to a zero of it. We would 
hke to apply Lemma 5.4.12 to the series —x'^3'{x) = —x^^- But this se- 
ries is not of type {A, n) because its coefficients are a bit too large. So we set 
R={l-\- \q\)/2 and we set^Six) = -x'^B? x 3'{Rx). From the hypothesis 
in the lemma there exists a positive real such that log < —n x L~^^. 
From Equation (12.5) there exists an absolute constant k such that the coef- 
ficient of in —x^ X J'(x) is < exp(K^n). This implies that the series 
5(x) has type (exp(L^''), 7^4) for some K4 > 1. We apply Lemma 5.4.12 
of Chapter 5 to the series at q/R and we are done. □ 

12.13.3 The neighborhood of a non-special divisor 

The singular locus of the Jacobi integration map cf) : ^ J is a strict 
closed subset. So every non-special effective degree g divisor has a neigh- 
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borhood in Sym^ X consisting of non-special divisors. In this section, we 
provide a quantified version of this statement. We first need to define sim- 
ple neighborhoods of the divisor P in Equation (12.97). Let e be a positive 
real number. We call Ve the set of degree g effective divisors P' that can 
be written P' = Ei<fc<if Ei<m<nfc Pk,m where P'^^ = {ik,q'k,J and 
Wk,m-(lk\ <e- 

We assume that P is non-special. We expect that if e is small enough, then 
P' is non-special as well. In order to write down the analytic conditioning 
of P' we must take multiplicities into account. So we rewrite P' as 

l<k<K l<s<Sk 

where = {mk^s)i<s<Sk is a partition of into non-empty parts. In 
particular 

nk = mk,i + mk,2 H h ruk^Sk- 

For every 1 < k < K we call 

Xk = q-jk - Qk 

the local analytic parameter at P^. We call the vector in (C[[xfe]])^DR 
defined by 

ffe = f Taylor (-^, q^) ) G (C[[xfe]])^DR (12.100) 

where Taylor (^3^ , Qk^ is the Taylor expansion of at qk in the param- 
eter Xk- 

For every 1 < k < K and 1 < s < Sjfc we write 

Pk,s = {jk,qk,s) 

and we set yk^s = qk,s " 9fc- 

The analytic conditioning of P is the Wronskian in Equation (12.46) eval- 
uated at (0, 0, . . . , 0) G C''^ and divided by n! = '[{i<k<K ^fc' 

The analytic conditioning of P' is the Jacobian in Equation (12.47) di- 
vided by m! = ni<fe<i<: ni<s<5fc "^A;,s' More precisely, the Jacobian in 
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Equation (12.47) is m! times the Taylor expansion of the analytic condi- 
tioning in the parameters {yk,s)i<k<K;i<s<Sk- 

These two conditionings are related by Equation (12.48). The condition- 
ing at P' is divisible by the determinant -Dm,n relating the two partitions. 
And the quotient speciahzes to the conditioning at P times n!/m! 

Let S = Y.i<k<K ^k- Then J(ffc,mfc)i<fc<^ is a series in the S variables 

iyk,s)l<k<K;l<s<Sk- 

We assume that qk and ^ belong to -D(0, exp(— Tr/'u;^)). 

Using Equation (12.56) about the size of coefficients in modular forms, 
the type of refocused series as described in Section 12.4.3, the type of 
derivatives given in Section 12.4.6, the type of quotient series given in Sec- 
tion 12.4.5, we can prove that the series 



has type (exp(P), PI,;). 

We denote by A the opposite of the logarithm of the absolute value of the 
analytic conditioning of P. We call it the analytic illconditioning of P. It 
generalizes the illconditioning introduced in Section 12.10. The only differ- 
ence is that here we take multiphcities into account. Using Equation (12.48) 
and inequahty (12.32) on bounding the remainder, we now prove that if 



then P' is a non-special divisor also. According to Equation (12.99) the 
analytic illconditioning A is < {#Vf)®. So any divisor in the neighborhood 
Ve is non-special, provided e < exp(— (#V/)®). 

12.13.4 Relating the direct and inverse error 

We go on with the notation in the previous Section 12.13.3. We have a 
divisor P as in Equation (12.97). We denote by S(^nk)i<k<K '^^ J^^^ 
map 

{Rl,...,Rg)l-^{{Rl,...,Rn^},{R„-^ + l,...,Rni+n2}f-!{Rni+n2-t ^-nji_i + l,--;Rg}) 



^(ffc,mfc) 



m,n 



l<fc<Jf 



-loge>Z^ + A 



(12.101) 



and we check that the following diagram commutes: 
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X9 




We can see the divisor P as a point on the semi-symmetric prod- 
uct ni<fc<i<: Sym'*'' X. We call U e the unique 5-uple such that 

S{U) = P. 

We assume that P is a non-special divisor The map '?!*(nj.)i<j.<^ is thus 
a local diffeomorphism at P. However, the map (f) is not a local diffeomor- 
phism at U because S is not, unless the partition n is (1, 1, . . . , 1). We shall 
allow ourselves to write 0' instead of 4'{nk)i<k<K section. 

The previous Section 12.13.3 provides an expUcit analytic description 
of the maps <p (resp. at U (resp. P). We have local coordinates 
{zk,m)i<k<K; i<m<nk at U E X^ . If i? is a 5-uple in X^ we write 

R = {Rk,m)l<k<K;l<m<nk 

and we set 

Zk,m{R) = <lfkiRk,m) - Qk- 

For every 1 < A; < K we define the series G (C[[xfc]]) to be the 
formal integral 

Fk{xk) = / fk{xk)dxk = Ffc^i xxk + Ffc^2 xxf, + ... 
Jo 

where is the vector defined in Equation (12.100). This is the Taylor ex- 
pansion of the Jacobi map at the point P^. The Taylor expansion of (p atU 
is 

Taylor(0, [/) = ^ ^ Fkizk,m) 

l<k<Kl<m<nk 
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and it lies in 

,m)l<k<K;l<m<niJ\) • 

We stress that for every u in B^j^, the corresponding coordinate in the 
above Taylor expansion is a series of type 



{r,@xlg) (12.102) 

because it is mostly the expansion of a modular form at a point which is not 
too close to the boundary of the unit disk. 

We now spht this Taylor expansion in two pieces. We write 

Taylor(</.,C/) =ri+r2 

where Ti is a sort of principal part 

^1= E E E ^k,jxz{^ 

l<k<K l<m<nfc l<j<rn. 

^ E E E ^km 

l<k<K l<j<nk l<m<nk 

= E E ^k,j X l^Pk,nk,j{{Rk,l,Rk,2,---,Rk,nk}) 

l<k<K l<i<«fe 

= E E ^k,jXi^P„n,AS{R)), (12.103) 

l<k<K l<i<nfc 

and T2 = Taylor((/), — (pi is the corresponding remainder. It is clear 
from Equation (12.103) that Ti can be written 

Ti = TioS 

where T[ is the first order term (the differential) in the Taylor expansion of 

(j)' at P = S{U). We write T2 = S where T2 is the corresponding re- 
mainder. Our goal now is to prove that in many circumstances the principal 
term T[ dominates the remainder In order to control how close is R to 
U (or equivalently how close is S{R) to P) we set 



e{R)= max \zk,m{Rk,m)\ 

l<k<K;l<m<nk 

= ^ \(llkiRk,m) - Qk] 

l<k<K; l<m<nfc 
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and 

r]{S{R)) = max |z>'Pfc,nfcj({i?fc,i, i?fc,2, ■ ■ ■ , ^fc,nJ)l 

l<fc<K ; l<j<rn. 

and we assume that ri{S{R)) is < cxp(— /®). 

We first bound the remainder T2{R) = T2{S{R)) from above in terms of 
rj{S{R)). Using Buckhohz inequahty (5.10) we can bound the coordinates 
Zk,m{R) = <?7fe {Rk,m) — Qk for every I < k < K and 1 < m < in terms 
of the bound rf{S{R)) on Newton power functions: 

\zk,mm < 5r?(5(ii))V-'= 

so 

Using the type estimate in Equation (12.102) and Equation (12.32) we 
deduce that 

\Ti{S{R))\^ < exp(/e) X n{S{R))'+'/^. (12.104) 

We now bound from below Ti{R) = T{{S{R)) in terms of 
This time we need some hypothesis on the divisor P. We assume that we 
are in the context of Theorem 12.10.2. We call Q, the cuspidal divisor Dq 
constructed in Section 8.1 and we assume that the class of P— O corresponds 
to a point x in the Ramanujan subspace Wf C J. We note that T[ is a 
linear map and its matrix in the bases {i^Pi,,nk,j)i<k<K-i<j<nk B^j^ 
is the matrix J\A'^°' of Equation (12.98). The coefficients in this matrix 
are < /® in absolute value. The determinant of this matrix is the analytic 
conditioning. According to Equation (12.99) the analytic conditioning at 
such a Ramanujan /-torsion divisor is > exp(— (^^V/)®). We deduce that 

\Ti{SiR))\^ > eM-iWff ) X v{S{R)). (12.105) 
We deduce from Equations (12.105) and (12.104) that 
\T[{S{R))\^>2\n{S{R))\^ 
as soon as e{R) < exp(-(#y/)®). 
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Using Lemma 12.13.5 below we deduce that there exist two absolute pos- 
itive constants ki and K2 such that if 

\cl>{R)-cl>'{P)\^<eM-mfr) 

then there exists a divisor S in ni<fc<ii: Sym"* X such that 

riiS) < eMiWfr) X im - <^'(P)L 

and0'(5) = (f>{R). 

Using again that the conditioning of P is > exp(— (#V/)®) together 
with the estimates in Section 12.13.3, e.g. Equation (12.101), we deduce 
that if the constant ki has been chosen big enough, then this divisor S is 
non-special. Therefore S = S{R) and we have proven that 

viS{R)) < eMiWfr) X \HR) - <t>'{P)L 

therefore 

e{R) < eMmfD X \m - ^'{P)L 

for some absolute positive constant K3. 

This relation between the error in J and the error in finishes the proof 
of Theorem 12.10.2. 

To finish this section there remains to state and prove Lemma 12.13.5. 

12.13.5 Lemma (Perturbation of a non-singular linear map) Let g > 1 

be a positive integer and let P{Og, Ig) G be the closed polydisk with 
polyradius Ig and centered at the origin. Let T : P{Og,lg) be 
a continuous function and let Ti : — > be a linear function. Set 
T2 = T — Ti and assume that for every R = . . . , Rg) in P{Og, Ig) we 
have \Ti{R)\^ > 2|T2(P)|oo. Let K > be a positive real number such 
that for every RinC^ 

mR)\^>Kx\R\^. 

Then the image by T of the polydisk P{Og, Ig) contains the polydisk 
P{Og, f X Ig) with polyradius K/2 x Ig. 
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For every real number t e [0, 1] we denote by St the image by Ti + tT2 
of the L°° -sphere with radius 1. Then St is contained in 

C^-P(0„y XI,) 

for every t G [0, 1]. So Si is homologous to Sq in — -P(Og, ^ x Ig) and 
its class in 

i/2,-i(c^-m,y xi,),z) 

is non-zero. So for every x in -P(Og, ^ x Ig), the class of Si in 
H2g-i{C^ — {x}, Z) is non-zero either. Assume now that x does not belong 
to the image by T of the polydisk P{Og, Ig). Then Si is the boundary of 
T{P{Og, Ig)) c Cf - {x} and its class in H2g-i{C3 - {x},Z) is trivial. A 
contradiction. □ 



12.14 FEVAL RESULT OF THIS CHAPTER 

We now state the final result of this chapter. 

12.14.1 Theorem (Approximating Vf over the complex numbers) 

There exists a deterministic algorithm that takes as input an even integer 
k > 2, a prime integer I > 6{k — 1), a finite Geld F with characteristic I, 
a ring epimorphism f : T(l, k) — ^ F, and a cuspidal divisor Q on Xi{5l) 
like the divisor Dq constructed in Section 8.1, and computes complex 
approximations for every element in W f C Ji{5l), the image of Vf C Ji{l) 
by B^i I ^. Here Vf C Ji{l) is defined by Equation (12.1) and we assume 
that the image of the Galois representation pf associated with f contains 
SL{Vf). The algorithm returns for every element x in Wf the unique degree 
g effective divisor such that Qx — ^ hes in the class represented by x. 
More precisely, the algorithm returns the cuspidal part Q^"**^ of Qx and 
a complex approximation of its finite part Q^"^ = ^i<„<rf^ Qx,n- Every 
point Qx,n is given by complex approximations of its affine coordinates 
{b{Qx,n), x{Qx,n)) io th^ plane model Ci of Xi (51) given in Section 12.3.3. 
The running time of the algorithm is < (m x #V/)® for some absolute 
constant 6. Here #V/ is the cardinality of the Galois representation Vf and 
m is the required absolute accuracy. 
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There are only two differences between this Theorem 12.14. 1 and the pre- 
vious Theorem 12.10.2. Firstly we claim that we can separate the cuspidal 
and the finite part of Qx- Secondly we return algebraic coordinates h and x 
for the points Qx,i rather than analytic ones. 

Indeed, Theorem 12.10.2 gives us for every point P in the support of Qx 
an analytic coordinate (7, q). We want to decide if the point P in question 
is equal to 7(00). Let j be Klein's modular function. We know that both the 
degree and the logarithmic height of ]{P) are < (#V/)®. So there exists 
an absolute constant ki such that if l/j(-P) is < exp(— (^V/-)"!) then it is 
zero. But the Petersson-Rademacher inequality tells us that there exists an 
e > such that if x is a complex number bounded by e in absolute value 
then 

where i{x) is Klein's series given in Equation (12.3). Using Equation (12.4) 

we deduce that there exists an absolute constant K2 such that if q is 
< exp(— then g = and the point P = (7, q) is the cusp 7(00). 
This explains why we can recognize cusps. 

Now assume that P = (7, q) is a point in the support of some Qx and 
assume that P is not a cusp. Then \q\ > e-x.p{—{j^Vf )'^^) and in order to 
compute b{P) and x{P) we just substitute q^hy qin the expansions for x 
and b at 7(00) computed in Section 12.3. 
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Chapter Thirteen 



Computing Vf modulo p 

J.-M. Couveignes 

In this chapter we address the problem of computing in the group of l''- 
torsion rational points in the jacobian variety of algebraic curves over finite 
fields, with an application to computing modular representations. 

Let p be a prime and let Fp = Z/pZ be the field with p elements. Let ¥p 
be an algebraic closure of Fp. For any power g of p we call F^ C Fp the 
field with q elements. Let C be the affine and projective planes over 
¥q. Let C C be a plane projective geometrically integral curve over Fg. 
Let X be its smooth projective model and let J be the jacobian variety of 
X. We note g the genus of X and d the degree of C. We assume that we 
are given the numerator of the zeta function of the function field ¥q{X). So 
we know the characteristic polynomial of the Frobenius endomorphism Fq 
of J. This is a monic degree 2g polynomial x{^) with integer coefficients. 

Let / 7^ p be a prime integer and let A; > 1 be an integer. We look 
for a nice generating set for the group J[l'^]{¥q) of /'^-torsion points in 
J{¥q). By nice we mean that the generating set {gi)i<i<i should induce 
a decomposition of J\l^]{¥q) as a direct product ni<i<7 < 5i > of cyclic 
subgroups with non-decreasing orders. Given such a generating set and an 
Fg-endomorphism of J, we also want to describe the action of this endo- 
morphism on J[l^] i¥q) by an / X / integer matrix. 

By an algorithm in this paper we usually mean a probabilistic Las Ve- 
gas algorithm. In some places we shall give deterministic algorithms or 
probabilistic Monte-Carlo algorithms, but this will be stated explicitly. See 
Section 5.1 for a reminder of computational complexity theory. The main 
reason for using probabilistic Turing machines is that we shall need to con- 
struct generating sets for the Picard group of curves over finite fields. Solv- 
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ing such a problem in the deterministic world is out of reach at this time. 
See Section 5.1. 

In Section 13.1 we recall how to compute in the Picard group J(Fg). Sec- 
tion 13.2 gives a naive algorithm for picking random elements in this group. 
Pairings are useful when looking for relations between divisor classes. So 
we recall how to compute pairings in Section 13.3. Section 13.4 is con- 
cerned with characteristic subspaces for the action of Frobenius inside the 
/oo -torsion of J(Fp). In Section 13.5 we look for a convenient surjection 
from J(Fq) onto its /'^-torsion subgroup. We use the Kummer exact se- 
quence and the structure of the ring generated by the Frobenius endomor- 
phism. In Section 13.6 we give an algorithm that, on input a degree d plane 
projective curve over ¥q, plus some information on its singularities, and the 
zeta function of its function field, returns a nice generating set for the group 
of ^^-torsion points inside J{¥q) in probabilistic polynomial time in log q, 
d and l^. In Section 13.7 we apply the general algorithms in Section 13.6 
to the modular curve Xi{bl) in order to compute explicitly a modular rep- 
resentations Vf modulo /. Such a representation modulo / can be realized as 
a subgroup Wf inside the Z-torsion of Ji(5Z)/Q. The idea is to compute the 
reduction modulo p of the group scheme Wf as a subgroup of Ji (5Z) /Fp, 
for many small primes p. One can then lift using the Chinese Remainder 
Theorem, as will be explained in Section 14.8. 

Remark. The symbol in this chapter stands for a positive effective abso- 
lute constant. So any statement containing this symbol becomes true if the 
symbol is replaced in every occurrence by some large enough real number. 

13.1 BASIC ALGORITHMS FOR PLANE CURVES 

In this section, we recall elementary results about computing in the Picard 
group of an algebraic curve over a finite field. See [Hac, Vol, Die] for a 
more detailed treatment. 

13.1.1 Finite fields 

We should first explain how finite fields are represented. The prime field 
Fp is just Z/pZ so elements in it are represented as integers in [0,p — 1[. 
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The base field Fg is given as ¥p[x\/ f{x) where f{x) is an irreducible uni- 
tary polynomial with degree a in Fp[x] where p is the characteristic and 
q = p"'. A finite extension of Fg is given as ¥q[y\/h{y) where h{y) is a 
unitary irreducible polynomial in Fg [y\ . We shall never use two extensions 
of ¥q simultaneously. Remind polynomial factoring in Fg[x] is Las Vegas 
probabilistic polynomial time in log q and the degree of the polynomial to 
be factored [Ga-Ge, Chapter 14]. 



13.1.2 Plane projective curves and their smooth model 

We now explain how curves are represented in this paper. To start with, 
a projective plane curve C over F^ is given by a degree d homogeneous 
polynomial E{yi, y, z) in the three variables x, y and z, with coefficients in 
Fg. The curve C is assumed to be absolutely integral. By a point on C 
we mean a geometric point: an element of C(Fg) where Fg = Fp is the 
algebraic closure of ¥p fixed in the introduction. Any Fg-point on C can be 
represented by its affine or projective coordinates. 

Let X be a smooth model of C and let X — C be the desingularization 
map. If P e -'^(Fg) is a geometric point on X above a singular point S 
on C, we say that P is a singular branch. The conductor <t is an effec- 
tive divisor on X. It is the closed subscheme of X defined by the sheaf 
A.rmoc{Ox/Oc)- Every multiplicity in Cis even. Some authors call (Cthe 
adjunction divisor. Its support consists of all singular branches. The con- 
ductor expresses the local behaviour of the map X ^ C. See [Serl, IV.l], 
[Gor]. We have deg(£) = 25 where 

^ {d-\){d-2) 

2 ^ 

is the difference between the arithmetic genus of C and the geometric 
genus of X. Since 5 < {d — l)(d — 2)/2, the support of C contains at 
most {d — l){d — 2)/2 geometric points in X{¥q). So the field of def- 
inition of any singular branch on X is an extension of Fg with degree 
< ((i — — 2)/2. A modem reference for singularities of plane curves 
is [Cas, Section 5.8]. 

The smooth model X of C is not given as a projective variety. Indeed, 
we shall only need a nice local description of X above every singularity of 
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C. This means that we need a hst of all singular points on C, and a list 
(a labelling) of all points in X{¥q) lying above every singularity of C (the 
singular branches), and a uniformizing parameter at every such branch. We 
also need the Laurent series expansions of affine plane coordinates in terms 
of all these uniformizing parameters. 

More precisely, let P G X{¥q) be a geometric point above a singular 
point S, and let v be the corresponding valuation. The field of definition of 
P is an extension field Fp of with degree < {d — \){d — 2) /2. Let xs 
and ys be affine coordinates that vanish at the singular point S on C. We 
need a local parameter tp at P and expansions a:;^ = J2k>v(xs) ^ktp and 
ys = T,k>v{ys) ^ktp with coefficients in Fp. 

Because these expansions are not finite, we just assume that we are given 
a black box that on input a positive integer n returns the first n terms in 
all these expansions. In all the cases we shall be interested in, this black 
box will contain a Turing machine that answers in time polynomial in n and 
log q and the genus g. This is the case for curves with ordinary multiple 
points for example. We have shown in Section 12.3 that this is also the 
case for the standard plane model of modular curves Xi (5/). Using general 
normaUzation and factorization algorithms [Die, Section 2] one may show 
that this is indeed the case for all plane curves without any restriction, but 
this is beyond the scope of this text. 

We may also assume that we are given the conductor C of C as a combina- 
tion of singular branches with even coefficients. The following algorithms 
still work if the conductor is replaced by any divisor D that is greater than 
the conductor and has polynomial degree in d. Such a divisor can be found 
easily: the singular branches on X are supposed to be known already, and 
the multiplicities are bounded above by {d — — 2)/2. 

13.1.3 Divisors, forms, and functions 

Smooth Fy -points on C are represented by their affine or projective coor- 
dinates. Labelling for the branches above singular points is given in the 
description of X. So we know how to represent divisors on X. For any in- 
teger /i > the F^-Unear space H^{F^, Op2{h)) of degree h homogeneous 
polynomials in X, y, and z has dimension {h + l){h + 2)/2. A basis for it is 
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made of all monomials of the form x^y^z'^ with a, 6, c € N and a+b+c = h. 
We denote by Ox{h) the puUback of Op2{h) to X. Let F be a degree h 
form on having non-zero puUback Fx on X. Let A = {Fx ) be the divi- 
sor of this restriction. The map / i-> is a bijection from H^{X, Ox{h)) 
to the hnear space H^{X, Ox (A)) associated with A. 

We assume that we are given a divisor D bigger than the conductor 
We assume that the degree of 2) is < . We have explained in 
the previous Section 13.1.2 how to find such a divisor. The dimension of 
H'^{X, Oxih){-^)) is at least dh + 1- g - deg(D) and is equal to this 
number when it exceeds ^ — 1. This is the case if 

d 

The dimension of Ox{h){-D)) is greater than 2g if 

M deg2) 

We take h to be the smallest integer fulfilUng this condition. The com- 
posite map X^Cm-P^ induces a map 

Ph : H\v\Op2{h)) ^ H\X,Ox{h)). 

The image of ph contains H^{X, Ox{h){—T))). This is known as Noether's 
residue theorem [Gor, Theorem 7]. It will be convenient to describe 
Ox{h){-'Z)) as a quotient 

^ Keiph ^ pl\H\X,Ox{h){-'S)))) ^ H\X, 0x^-1))) ^ 0. 
We need linear equations for 

pl\H\X,Oxm-^))) C H\¥\Op2{h)). 
We consider a generic homogeneous form 

F(x,y,z)= eaAc^Vz'^ 
a+6+c=/i 

of degree /i in x, y and z. For every branch P above a singular point S & C 
(assuming for example that S has non-zero z-coordinate) we replace in 
|, 1) the affine coordinates x = ^ and y = f by their expansions 
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as series in the local parameter tp at this branch. We ask the resulting series 
in ip to have valuation at least the multiplicity of P in the divisor 2). Every 
singular branch thus produces linear equations in the ea,b,c- The collection 
of all such equations defines the subspace pf^^{H^{X, Ox{h){—D))). 

A basis for the subspace Kerp^ of pf^^{H'^{X,Oxih){—D))) consists 
of all x"y''z^£'(x, y, z) with a + b + c = h — d. We fix a supplemen- 
tary space M(7 to Ker ph in pJ^^{H^{X,Oxih){—D))) and we assimilate 
H^{X, Ox{h){~T))) to it. 

Given a homogeneous form in three variables one can compute its divi- 
sor on X using resultants and the given expansions of affine coordinates in 
terms of the local parameters at every singular branch. A function is given 
as a quotient of two forms. 

13.1.4 The Brill-Noether algorithm 

The hnear space Mc computed in the previous paragraph is isomorphic to 

H^{X,Ox{h){—Ti)) via the map ph- This space allows us to compute in 
the group J(Fg) of Fg-points in the jacobian of X. We fix an effective F^- 
divisor Q with degree g on X. This Q will play the role of origin: a point 
a G J(Fq) is represented by a divisor A — $7 in the corresponding linear 
equivalence class, where A is an effective F^-divisor on X with degree g. 
Given another point P G J(Fq) by a similar divisor S — we can compute 
the space H^{X,Ox{h){—'S — A — B)) which is non-trivial and pick a 
non-zero form Fi in it. The divisor of Fi is (Fi ) = A + B + D + R where 
R is an effective divisor with degree hd — 2g — deg{D). The linear space 
{X, Oxih)i-'T>- R-n)) has dimension at least 1. We pick a non-zero 
form F2 in it. It has divisor (F2) = S? + i? + il + D where D is effective 
with degree g. And D — ^lis linearly equivalent to A — + D ~ Q. 

In order to invert the class a of ^ — we pick a non-zero form Fi in 
H^{X,Ox{h){-^-2n)). The divisor of Fi is (Fi) = 20 + 2) + i? where 
i? is an effective divisor with degree hd — 2g — deg(S)). The hnear space 
H^{X, Ox (/i) (— 2) — R — A)) has dimension at least 1. We pick a non-zero 
form F2 in it. It has divisor (F2) = D + R + A + B where B is effective 
with degree g. And i? — O is hnearly equivalent to — (A — O). 

13.1.5 Lemma (Arithmetic operations in the jacobian) Let C/Fg be a 
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degree d plane projective absolutely integral curve. Let g he the geometric 
genus ofC. Assume that we are given the smooth model XofC and a¥q- 
divisor with degree g on X, denoted $7. We assume that Q, is given as a dif- 
ference between two effective divisors with degrees bounded by d® . This $7 
serves as an origin. Arithmetic operations in the Picard group Pic°(X/Fg) 
can be performed in time polynomial in log q and d. This includes addition, 
subtraction and comparison of divisor classes. 

If n is not effective, we use Lemma 13.1.6 below to compute a non-zero 
function / in H^{X,Ox{^)) and we write n' = (/) + n. This is an 
effective divisor with degree g. We replace Q by W and finish as in the 
paragraph before Lemma 13.1.5 □ 

We now recall the principle of the Brill-Noether algorithm for comput- 
ing complete linear series. Remind functions in ¥q{X) are represented as 
quotients of forms. 

13.1.6 Lemma (Brill-Noether) There exists an algorithm that on input a 
degree d plane projective absolutely integral curve C/¥q and the smooth 
model X of C and two effective ¥q-divisors A and B on X, computes a 
basis for H^{X, Ox {A — B)) in time polynomial in d and \ogq and the 
degrees of A and B. 

We assume that deg(A) > deg(B), otherwise H^{X, Ox{A - B)) = 0. 
Let a be the degree of A. We let h be the smallest integer such that 

hd-g + l>a + degD. 

The space H'^{X,Ox{h){—D — A)) is non-zero. It is contained in the 
image of the map 

Ph : H\¥\0^2{h)) ^ H\X,Ox{h)) 

so that we can represent it as a subspace of H^{f''^ ,Of2{h)). We pick 
a non-zero form / in H'^{X,Ox{h){—D — A)) and compute its divisor 
{f) = ^ + A + D. The space H^{X, Ox {h){-^ - B - D)) is contained 
in the image of the map ph so that we can represent it as a subspace of 
H^{¥^, Of,2 (h)). We compute forms 71, 72, . . . , 7fe in H^{¥^, O^i (h)) such 
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that their images by ph provide a basis for H^{X, C'x(^)(— ® — B — D)). 
A basis for H^{X, Ox {A - B)) is made of the functions f,f,...,f.n 
We deduce an expUcit moving lemma for divisors. 



13.1.7 Lemma (Moving divisor lemma I) There exists an algorithm that 

on input a degree d plane projective absolutely integral curve C/¥g and 
the smooth model X of C and a degree zero divisor D = D+ — D~ and an 
effective divisor A with degree < qonX computes a divisor E = — E~ 
linearly equivalent to D and disjoint to A in time polynomial in d and log q 
and the degrees of D^, and A. Further the degree of and E~ can be 
taken to be < 2gd. 

Let O be an Fg-rational divisor on X such that 1 < deg(O) < d, and dis- 
joint to A. We may take O to be a well chosen fiber of some plane coordinate 
function on X. We compute the linear space (X, Ox -D~+2gO)). 
The subspace of H^{X, Ox{E)^ — D~ + 2gO)) consisting of functions / 
such that (/) + — D~ + 2gO is not disjoint to A is contained in a union 
of at most deg(^) < q hyperplanes. We conclude invoking Lemma 13.1.8 
below. □ 

There remains to state and prove the 

13.1.8 Lemma (Solving inequalities) Let q be a prime power, d > 2 and 
n > 1 two integers and letHi, Hn be hyperplanes inside V = F^, each 
given by a Unear equation. Assume that n < q. There exists a deterministic 
algorithm that finds a vector in U = V — Ui<A;<n ^ time polynomial in 
log q, d and n. 

This is proved by lowering the dimension d. For cZ = 2 we pick any affine 
line LinV not containing the origin. We observe that there are at least q — n 
points inUnL = L — Ui<fc<n ^ ^ ^k- We enumerate points in L until we 
find one which is not in any i/^. This requires at most n + 1 trials. 

Assume now that d is bigger than 2. Hyperplanes in V are parametrized 
by the projective space F{V) where V is the dual of V. We enumerate points 
in P(l/) until we find a hyperplane K distinct from every Hk. We compute 
a basis for K and an equation for every Hf^Ci K in this basis. This way, we 
have lowered the dimension by 1. □ 
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We can strengthen a bit the moving divisor algorithm by removing the 
condition that A has degree < q. Indeed, in case this condition is not met, 
we call a the smallest integer such that > deg(yl) and we set /3 = a + 1. 
We apply Lemma 13.1.7 after base change to the field with elements 
and find a divisor Ea. We call ea the norm of from F^a to F^. It is 
equivalent to aD. We similarly construct a divisor ep that is equivalent to 
{a + 1)D. We return the divisor E = ep — e^. We observe that we can 
take a < 1 + log^ dcg(A) so the degree of the positive part E^ of E is 

< Qgd{\ogq{deg{A)) + 1). 

13.1.9 Lemma (Moving divisor lemma 11) There exists an algorithm that 
on input a degree d plane projective absolutely integral curve C/¥q and the 
smooth model X of C and a degree zero ¥q-divisor D = — D~ and 
an effective divisor A on X computes a divisor E = E^ — E^ linearly 
equivalent to D and disjoint to A in time polynomial in d and log q and the 
degrees of , and A. Further the degree of E~^ and E~ can be taken to be 

< 6gd{logqidegiA)) + 1). 

13.2 A FIRST APPROACH TO PICKING RANDOM DIVISORS 

Given a finite field ¥q and a plane projective absolutely integral curve C 
over ¥q with projective smooth model X, we call J the jacobian of X and 
we consider two related problems: picking a random element in J{¥q) with 
(close to) uniform distribution and finding a generating set for (a large sub- 
group of) J{¥q). Let g be the genus of X. We assume that we are given a 
degree 1 divisor O = 0+ — 0~ where 0+ and 0~ are effective, F^-rational 
and have degree bounded by 65® for some positive constant B. 

We know from [Mu-St-Th, Theorem 2] that the group Pic°(X/Fq) is 
generated by the classes [p — deg(p)0] where p runs over the set of prime 
divisors of degree < 1 + 2 \ogq{4:g — 2). For the convenience of the reader 
we quote this result as a lemma. 

13.2.1 Lemma (Miiller, Stein, Thiel) Let K bean algebraic function held 
of one variable over ¥q. Let N > be an integer Let g be the genus of 
K. Let X '■ Div(ir) — > C* be a character of finite order which is non-trivial 
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when restricted to Div°. Assume that x(®) = 1 for every prime divisor 58 
of degree < N. Then 

N <2logg{4g-2). 

If q < Ag^, the number of prime divisors of degree < 1 + 2 \ogq{4,g — 2) 
is bounded by Qg^\ So we can compute easily a small generating set for 
J(Fg). In the rest of this section, we will assume that the size q of the field 
is greater than or equal to Ag"^. This condition ensures the existence of a 
Fq-rational point. 

Picking efficiently and provably random elements in J(Fg) with uniform 
distribution seems difficult to us. We first give here an algorithm for ef- 
ficiently constructing random divisors with a distribution that is far from 
uniform but still sufficient to construct a generating set for a large subgroup 
of J(Fq). Once given generators, picking random elements becomes much 
easier. 

Let r be the smallest prime integer bigger than 30, 2(7 — 2 and d. We 
observe r is less than max(45 — 4, 2(i, 60). The set V{r,q) of Fg -places 
with degree r on X has cardinality 



#r{r,q) 

So 



#X(Fy,.)-#X(F,) 



(1 - 10-2)^ < #P(r, q)<{l + 10-')^. 



Indeed, |#X(Fgr) - q' - 1\ < 2gq2 and |#^(Fg) - q - 1\ < 2gq2 
So 



#rir,q)-- 
r 



4(J + 3 r r 

< — < 8g2 

r 



and 8rq^ < r2^~i < 10~^ since r > 31. 

Since we are given a degree d plane model C for the curve X, we have a 
degree d map x : X — > P^. This is the composition of the desingularization 
map X ^ C with the restriction to C of the rational map [x, y, z] — >■ [x, z]. 
Since d < r, the function x maps V{r, q) to the set U{r, q) of monic prime 
polynomials of degree r over ¥q. The cardinality of U (r, q) is^so 

(l_10-9)^^<#W(r,g)<^. 

r r 
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The fibers of the map x : V{r,q) ^ W(r, q) have cardinahty between 
and d. We can pick a random element in U (r, q) with uniform distribution 
in the following way: we pick a random monic polynomial of degree r with 
coefficients in ¥q, with uniform distribution. We check whether it is irre- 
ducible. If it is, we output it. Otherwise we start again. This is polynomial 
time in r and log q. 

Given a random element in U{r,q) with uniform distribution, we can 
compute the fiber of x : V{r,q) — U{r,q) above it and, provided this 
fiber is non-empty, pick a random element in it with uniform distribution. If 
the fiber is empty, we pick another element in U{r, q) until we find a non- 
empty fiber. At least one in every d x (0.99)~^ fibers is non-empty. We thus 
define a distribution fi on V{r, q) and prove the following. 

13.2,2 Lemma (A very rough measure) There is a unique measure /i on 
V{r,q) such that all non-empty fibers of the map x : V{r,q) ^ U{r,q) have 
the same measure, and all points in a given Eber have the same measure. 
There exists aprobabiUstic algorithm that picks a random element in V{r, q) 
with distribution jj, in time polynomial in d and log q. For every subset Z of 
V{r, q) the measure n{Z) is related to the uniform measure ^^^g^ by 

#Z d#Z 
dW{r,q) #r{r,q)- 

Now let V{r, q) be the set of effective F^-divisors with degree r on X. 
Since we have assumed that q > 4g'^ we know that X has at least one F^- 
rational point. Let O be a degree r effective divisor on X/¥q. We associate 
to every a in P(r, q) the class of a — J7 in J(Fg). This defines a surjection 

(t>r:V{r,q)^Ji¥q) 

with all its fibers having cardinality #P''~^(Fq). So the set V{r,q) has 
cardinality ^-^^#J{¥q). So 

1 - i 1 

#V{r,q) < #Vir,q) < q'-^ ^ ^ g^(l + —f'- 

Since q > Ag^ we have 

#P(r,5)<2e/. 
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Assume that G is a finite group and V' an epimorphism of groups 

^ ■ J(Fg) ^ G. 
We look for some divisor A G P(r, q) such that 

Since all the fibers oi^o(j)^ have the same cardinahty, the fiber above has 
at most 

#G 

elements. So the number of prime divisors A G 7'(r, q) such that il){(j)r{^)) 
is not is at least 

^,0.99 2e 



We assume that #G is at least 12r. Then at least half of the divisors in 
P(r, q) are not mapped onto by V' o 0r- The /i-measure of the subset con- 
sisting of these elements is at least ^. So if we pick a random A in V{r, q) 
with /i-measure as in Lemma 13.2.2, the probabiUty of success is at least 
^. If we make 2d trials, the probabihty of success is > 1 — exp(— 1) > ^. 

13.2.3 Lemma (Finding non-zero classes) There exists a probabilistic 
(Monte-Carlo) algorithm that takes as input 



1. a degree d and geometric genus g plane projective absolutely integral 
curve C over Fg, such that q > 4^^, 

2. the smooth model X of C, 



3. a degree 1 divisor O = 0+ — O where 0+ and O are effective, Fq- 
rational and have degree bounded by @g® for some positive constant 

e, 

4. an epimorphism ijj : Pic^{X/¥q) G (that need not be computable) 
such that the cardinality of G is at least max(485, 2Ad, 720), 

and outputs a sequence of 2d elements in Pic°(X/Fg) such that at least one 
of them is not in the kernel of tp with probability > \. The algorithm is 
polynomial time in d and log q. 
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As a special case we take G = Gq = J{¥q) and t/j = tpo the identity. Ap- 
plying Lemma 13.2.3 we find a sequence of elements in J{¥q) out of which 
one at least is non-zero (with high probability). We take Gi to be the quo- 
tient of G by the subgroup generated by these elements and V'l the quotient 
map. Applying the lemma again we construct another sequence of elements 
in J(Fq) out of which one at least is not in Go (with high probabiUty). We 
go on like that and produce a sequence of subgroups in J{¥q) that increase 
with constant probability until the index in J(Fg) becomes smaller than 
max(48g, 24(1, 720). Note that every step in this method is probabilistic: it 
succeeds with some probabiUty, that can be made very high (exponentially 
close to 1) while keeping a polynomial overall complexity. 

13.2.4 Lemma (Finding an almost generating set) There exists a proba- 
bilistic (Monte-Carlo) algorithm that takes as input 

1. a degree d and geometric genus g plane projective absolutely integral 
curve C over Fg, such that q > Ag^, 

2. the smooth model X of C, 

3. a degree 1 divisor O = 0+ — where 0+ and are effective, ¥g- 
rational and have degree bounded by 65® for some positive constant 

e, 

and outputs a sequence of elements in Pic°(X/Fq) that generate a subgroup 
of index at most 

max(485, 2Ad, 720) 

with probability > \. The algorithm is polynomial time in d and log q. 

Note that we do not catch the whole group J{¥q) of rational points but 
a subgroup Q with index at most l = max(48(/, 24(i, 720). This is a small 
but annoying gap. In the sequel we shall try to compute the /-torsion of 
the group J(Fg) of rational points. Because of the small gap in the above 
lemma, we may miss some Z-torsion points if I is smaller than l. However, 
let A; be an integer such that > l. And let x be a point of order I in J{¥q). 
Assume that there exists a point y in J(Fg) such that x = l^~^y. The group 
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< y > generated by y and the group Q have non-trivial intersection because 
the product of their orders is bigger than the order of J(Fq). Therefore x 
belongs to Q. 

Our strategy for computing J(Fg) [I] will be to find a minimal field exten- 
sion Fq of ¥q such that all points in J{¥q) [I] are divisible by Z*^"^ in J(Fq). 
We then shall apply the above lemma to J(Fq). To finish with, we shall 
have to compute J(Fq) as a subgroup of J(Fq). To this end, we shall use 
the Weil pairing. 



13.3 PAIRINGS 

Let n be a prime to p integer and J a jacobian variety over ¥q. The Weil pair- 
ing relates the fuU n-torsion subgroup J(Fq) [n] with itself. It can be defined 
using Kummer theory and is geometric in nature. The Tate-Lichtenbaum- 
Frey-Riick pairing is more arithmetic and relates the n-torsion J(Fg)[n] in 
the group of Fg -rational points and the quotient J{¥q)/nJ{¥q). In this sec- 
tion, we quickly review the definitions and algorithmic properties of these 
pairings, following work by Weil, Lang, Menezes, Okamoto, Vanstone, Frey 
and Riick. 

We first recall the definition of Weil pairing following [Lan3]. Let k be 
an algebraically closed field with characteristic p. For every abelian variety 
A over k, we denote by Zo{A)o the group of 0-cycles with degree and by 
S : Zq{A)o ^ a the summation map, that associates to every 0-cycle of 
degree the corresponding sum in A. Let V and W be two projective non- 
singular integral varieties over k, and let a : V ^ A and (3 : W ^ Bbe the 
canonical maps into their Albanese varieties. Let D be a correspondence on 
V X W. Let n > 2 be a prime to p integer. Let o (resp. b) be a 0-cycle 
of degree on F (resp. W) and let a = S{a{a)) (resp. b = S{P{b))) be 
the associated point in A (resp. B). Assume that na = nh = 0. The Weil 
pairing en,D{0', b) is defined in [Lan3, VI, §4, Theorem 10]. It is an n-th 
root of unity in k. It is linear in a, b and D. 

Assume now that V = W = X isa. smooth projective integral curve over 
k and assume that A = B = J isits jacobian and 



a = p = (j):X^J 
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is the Jacobi map (once an origin on X has been chosen). If we take D to be 
the diagonal on X x X we define a pairing en,D{a, b) that will be denoted 
e„(a, b) or en,x{a, b). It does not depend on the origin for the Jacobi map. 
It is non-degenerate. 

The jacobian J comes with a principal polarization i.e. an isomorphism 
X : J ^ J between J and its dual J. If a is an endomorphism a : J ^ J, 
we denote by *a its transpose *a : J — J. If is a divisor on J that is 
algebraically equivalent to zero, the image by * a of the linear equivalence 
class of D is the linear equivalence class of the inverse image a~^{D). See 
[Lan3, V, §1]. The Rosati dual of a is defined to be a* = o o A. The 
map a ^ a* is an involution, and a* is the adjoint of a for the Weil pairing 

en,x{a,a{b)) = en,x {a* {a) , b) (13. 1) 

according to [Lan3, VII, §2, Proposition 6]. 

If Y is another smooth projective integral curve over k and K its jacobian 
and f : X Y a. non-constant map with degree d, and f* : K ^ J the 
associated map between jacobians, then for a and b of order dividing n in 
K one has 

en,x(r(a),r(6)) = e„,y(a,6)'^. 

The Frey-Ruck pairing can be constructed from the Lichtenbaum version 
of Tate's pairing [Lie] as was shown in [Fr-Ru]. Let g be a power of p. 
Let again n > 2 be a prime to p integer and let X be a smooth projective 
absolutely integral curve over Fg. Let g be the genus of X. We assume that 
n divides q — I. Let J be the jacobian of X. The Frey-Riick pairing 

{,}„ : J(F,)[n] X J{¥,)/nJ{¥g) ^ F;/(F*)" 

is defined as follows. We take a class of order dividing n in J(Fq). Such a 
class can be represented by an Fg-divisor D with degree 0. We take a class 
in J{¥g) and pick a degree zero Fg-divisor E in this class, that we assume 
to be disjoint to D. The pairing evaluated at the classes [D] and [E] mod n 
is 

{[D], [E] mod n}n = f{E) mod (F^" 
where / is any function with divisor nD. This is a non-degenerate pairing. 



bookarxiv March 23, 2010 



358 CHAPTER 13 

We now explain how one can compute the Weil pairing, following work 
by Menezes, Okamoto, Vanstone, Frey and Riick. The Tate-Lichtenbaum- 
Frey-Riick pairing can be computed similarly. As usual, we assume that 
we are given a degree d plane model C for X. Assume that a and b have 
disjoint support (otherwise we may replace o by some hnearly equivalent 
divisor using the explicit moving Lemma 13.1.7.) We compute a function 
fa with divisor na. We similarly compute a function with divisor nb. 
Then 

e„(a,6) = -^. 

This algorithm is polynomial in the degree d of C and the order n of the di- 
visors, provided the initial divisors o and b are given as differences between 
effective divisors with polynomial degree in d. 

Using an idea that appears in a paper by Menezes, Okamoto and Van- 
stone [Me-Ok-Va] in the context of elliptic curves, and in [Fr-Ru] for gen- 
eral curves, one can make this algorithm polynomial in log n in the follow- 
ing way. We write a = oq = — where and Oq are effective 
divisors. Let /„ be the function computed in the above simple minded al- 
gorithm. One has (/) = na^ — na^ . We want to express /„ as a product 
of small degree functions. We use a variant of fast exponentiation. Us- 
ing Lemma 13.1.7 we compute a divisor ai = — and a function /i 
such that Oi is disjoint to b and (/i) = Oi — 2ao and such that the degrees 
of O-i and a^f are < 6^d(logq(deg(b)) -I- 1). We go on and compute, for 
A; > 1 an integer, a divisor afc = — and a function fk such that Ofe 
is disjoint to b and (/^.) = — 2ofc_i and such that the degrees of 
and are < 6gd(logg{dcg{b)) + 1). We write the base 2 expansion of 
n = J2k ^k'^'^ with efe G {0, 1}. We compute the function $ with divisor 
efcOfc. We claim that the function fa can be written as a product of the 
/fe, for k < log2 n, and $ with suitable integer exponents bounded by n in 
absolute value. Indeed we write Fi = fi, F2 = /2/1 , F3 = /3/2/1 so 
on. We have {F^) = — 2'^a and 



^U^k'' 

k 

has divisor no so is the fa we were looking for. 
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13.3.1 Lemma (Computing the Weil pairing) There exists an algorithm 
that on input a prime to q integer n > 2 and a degree d absolutely inte- 
gral plane projective curve C over ¥q and its smooth model X and two 
¥q-divisors on X, denoted a = o"^ — a~ and b = b"*" — b", with degree 0, 
and order dividing n in thejacobian, computes the Weil pairing e„(a, b) in 
time polynomial in d, logg, logn and the degrees of a'^, a~, b'^, b~, the 
positive and negative parts of a and b. 

13.3.2 Lemma (Computing Tate-Lichtenbaum-Frey-Riick pairings) 

There exists an algorithm that on input an integer n > 2 dividing q — 1 
and a degree d absolutely integral plane projective curve C over Fg and its 
smooth model X and two ¥g-divisors on X, denoted a = o"*" — and 
b = — b~, with degree 0, and such that the class of a has order dividing 
n > 2 in the jacobian, computes the Tate-Lichtenbaum-Frey-Riick pairing 
{a, b}n in time polynomial in d, log q, log n and the degrees of , a~ , b"*", 
b~ , the positive and negative parts of a and b. 

13.4 DIVISIBLE GROUPS 

Let ¥q be a finite field with characteristic p and let X be a projective smooth 
absolutely integral algebraic curve over ¥q. Let g be the genus of X and let 
/ phe a prime integer. We assume that g > 1. Let J be the jacobian 
of X and let End( J/F^) be the ring of endomorphisms of J over ¥q. Let 
Fq be the Frobenius endomorphism. In this section we study the action of 
Fq on Z'^ -torsion points of J. We first consider the whole Z'^-torsion group. 
We then restrict to some well chosen subgroups where this action is more 
amenable. 

Let x{^) be the characteristic polynomial of Fq G End(J/Fq). The 
Rosati dual to Fqis q/Fq. Let 

O = Z[x]/x{x) 

and Oi = Zi[x]/x{x). We set 

(fq = X mod x{^) € ^■ 

Mapping Lpq onto Fq defines an epimorphism from the ring O onto 

In order to control the degree of the field of definition of Z'^ -torsion points 
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we shall bound the order of ipq in (O/l^O)*. We set 

Wi = {O/lOy = i¥i[x]/x{x)r. 

Let the prime factorization of x{x) mod I be Yl- Xii^Y' with deg(xi) = fi- 
The order of Wi is l{^i-'^)fiQfi _ i). Let 7 be the smallest integer such 
that P is bigger than or equal to 2g. Then the exponent of the group Ui 
divides 

A, = Pll{lf^-l). 

i 

We set 

i 

and 

Ci = P. 

There is a unique polynomial Mi (a;) G Z[x] with degree < 2g such that 

^^^^-^ =Mi((^,) G O. 

Now for every positive integer k, the element (pq belongs to the unit group 

Uk = {o/i^oy 

of the quotient algebra O/l'^O = 'L[x]/ [l^ ,x{x))- The prime factoriza- 
tion of x(x) mod I is hfted modulo Z*^ as Hi'^'ils^) with Sj monic and 
deg(Sj) = eifi, and the order of Wjt is f]. //iC^^^* - 1). The expo- 
nent of the latter group divides 

Ak = Ail^-\ 

So we set 

Bk = Bi = Hilf^ - 1) 

i 

and 
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There is a unique polynomial Mk{x) G Z[x] with degree < deg(x) such 
that 



For every integer N > 2 we can compute Mk{x) mod from x(a;) in 
probabilistic polynomial time in log q, log /, log A^, k, g. Indeed we first 
factor x{x) mod I then compute the Xi and the and /j. We compute 



using the fast exponentiation algorithm presented in Section 5.1. We remove 
1 and divide by Z'^. 

13.4.1 Lemma (Frobenius and /-torsion) Let k be a positive integer and 
I ^ p a prime. Let x{x) he the characteristic polynomial of the Frobenius 
Fq of J/¥q. Let Ci and fi be the multipUcities and inertiae in the prime 
decomposition of x{x) mod I. Let j be the smallest integer such that P is 

bigger than or equal to 2g. Let B = HjC^'^' - !)■ ^et Ck = and 
let Ak = BCk- The l'' -torsion in J splits completely over the degree Ak 
extension of¥q. There is a degree < 2g polynomial Mk{x) G Z[x] such 
that 



For every integer N one can compute such a Mfc(x) mod N from xix) in 
probabiUstic polynomial time in log q, log I, log N, k, g. 

In order to state sharper results it is convenient to introduce /-divisible 
subgroups inside the -torsion of a jacobian J, that may or may not corre- 
spond to subvarieties. We now see how to define such subgroups and control 
their rationality properties. 

13.4.2 Lemma (Divisible group) Let n : J[/°°] — > J[/°^] he a group ho- 
momorphism whose restriction to its image G is a bijection. Multiplication 
by I is then a surjection Irom G onto itself. We denote byGH^] the l'' -torsion 
in G. There is an integer w such that G [Z*^] is a free Z/l^Z module of rank w 
for every k. We assume that U conamutes with the Frobenius endomorphism 



Ak - 

Q 



= Mkiifq) e O. 



X 



mod {xix),l^N) 




1 + l^Mk{Fq). 
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Fq. We then say G is the divisible group associated with IT. From Fate's 
theorem [Fatl] H is induced by some endomorphism in End( J/Fg) 0^ Z/ 
and we can deGne U* the Rosati dual ofU and denote by G* = Im(n*) the 
associated divisible group, that we call the adjoint ofG. 

Remark. The dual G* does not only depend on G. It may depend on 11 
also. This will not be a problem for us. 

Remark. We may equivalently define 11* as the dual of 11 for the Weil 
pairing. See Equation (13.1). 

We now give an example of divisible group. Let F{x) = Fi{x) and 
G{x) = Gi (x) be two monic coprime polynomials in ¥i [x] such that 

x{x) = Fi{x)Gi{x) mod I. 

According to Bezout's theorem we have two polynomials Hi{x) and Ki{x) 
in F; [x] such that 

FiHi + GiKi = 1 

and deg(iJi) < deg(Gi) and deg(Ki) < deg(Fi). 

From Hensel's lemma, for every positive integer k there exist four poly- 
nomials Fk{x), Gk{x), Hk{x) and Kk{x) in {Z/l^Z)[x] such that F^ and 
Gfe are monic and 

X{x) = Fk{x)Gkix) mod 

and 

FkHk + GkKk = 1 mod l'' 

and deg{Hk) < deg(Gi) and deg{Kk) < deg(Fi) and Fi = F^ mod I, 
Gi = Gk mod I, Hi = mod Ki = mod I. 

The sequences (Ffc)fe, {Gk)k, {Hk)k, {Kk)k converge in 'Li[x\ to Fq, Gq, 
Hq, Kq. If we substitute Fq for x in FqHq we obtain a map 

Ug : J[l°°] ^ J[l^] 

and similarly, if we substitute Fq for x in GoKq we obtain a map 11^. It is 
clear that Uj, = Up and 11^ = Hg and XIp + Hg = 1 and UpUa = 0. 
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We call Gf = ImiUp) and Gq 
i-divisible groups. 
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= Im(nG') the associated supplementary 



13.4.3 Definition (Characteristic subspaces) For every non-trivial monic 

factor F{x) of x(x) mod / such that the cofactor G = x/F mod / is prime 
to F, we write x = FqGq the corresponding factorization in Z/[a;]. The 
/-divisible group 

Gf = Im(nF) 

is called the Fo-torsion in J[l°°] and is denoted J[l°°, Fq]. It is the charac- 
teristic subspace of Fq associated with the factor F.JfF = {x — 1)^ is the 
largest power of x — 1 dividing x{x) mod I we abbreviate G(a;_i)e = Gi. 
If F = {x — qY then we write similarly G(3._^)e = Gq. 

We notice that there exists a unit u in End(J/Fq) ®z '^i such that the 
Rosati dual n^; of IIi is 

= Hg o u. 

Therefore 

Gq — 

and the restriction of the Weil pairing to G\ x Gq [Z'^] is non-degenerate 

for any integer k>l. 

We now compute fields of definitions for torsion points inside such divis- 
ible groups. The action of Fq on the /^-torsion Gf[/^] = J[1^,Fq\ inside 
Gf factors through the ring C'^/(/^ Fo{ipq)) = Zi[x]/{l'', Fq). We deduce 
the following. 

13.4.4 Lemma (Frobenius and Fo-torsion) Let kbea positive integer and 
I p a prime. Let x{x) be the characteristic polynomial of the Frobenius 
Fq of J. Let X = FG mod I with F and G monic coprime. Let and fi be 
the multiplicities and inertiae in the prime decomposition of F{x) mod I. 
Let 7 be the smallest integer such that P is bigger than or equal to 2g. Let 
B{F) = US^' - !)• LetCkiF) = 1^-^+^^ and Ak{F) = B{F)Ck{F). 
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The l'' -torsion in Gp splits completely over the degree Ak{F) extension of 
¥q. There is a degree < deg(F) polynomial Mk{x) G Zi[x] such that 

Up o F^"^^^ =Uf + I'^Uf o Mk{Fg). 

For every power N of I, one can compute such an Mk{x) modulo N from 
x{x) and F{x) in probabilistic polynomial time in log q, log /, log N, k, g. 

If we take for F the largest power of x — 1 dividing x{^) mod / in the 
above lemma, we can take B{F) = 1 so Ak{F) is an I power < 2gl^. 

If we take for F the largest power oi x — q dividing x{x) mod I in the 
above lemma, we have B{F) = Z - 1 so Ak{F) is < 2g{l - 1)1''. 

So the characteristic spaces associated with the eigenvalues 1 and q split 
completely over small degree extensions of F^. 



13.5 THE KUMMER MAP 

Let X be a smooth projective absolutely integral curve over of genus g 
and J the jacobian of X. Let n > 2 be an integer dividing q—1. We assume 
that g > 1. In this section, we construct a convenient surjection from J(Fg) 
to J(¥q)[n]. If P is in J{¥g) we take some R G J{¥g) such that nR = P 
and form the 1-cocycle {"R — R)fj in {¥q, J[n]). Using the Weil pairing 
we deduce an element 

S^{en{''R-R,S))a 

in 

liom{J[n]{¥g),H\¥g,iin)) = Hom(J[n](F,), Hom(Gal(Fg), 

The map that sends P mod nJ{¥q) to 5 i-> {en{^R — R,S))a- is in- 
jective because the Frey-Riick pairing is non-degenerate. We observe that 
Hom(Gal(Fg), ;U„) is isomorphic to Hn because giving an homomorphism 
from Gal(Fg) to /i„ is equivalent to giving the image of the Frobenius gen- 
erator Fq. We obtain a bijection 

Tn,q : Ji¥q)/nJ{¥q) ^ Hom( J[n] (F,), 
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that we call the Tate map. It maps P onto S i— )■ Cni^'^R — R, S). If J[n] 
splits completely over ¥q we set Kn^q{P) = ^''R — R and define a bijection 

Kn,q : J(F,)/nJ(Fg) ^ JNCF,) = J[n] 

that we call the Kummer map. 

13.5.1 Definition (The Kummer map) Let J/F^ be a jacobian and n > 2 
a prime to p integer. Assume that J[n] splits completely over F^. For 
P in J{¥q) we choose any R in J{¥q) such that nR = P and we set 
Kn,q{P) = ^''R — R. This defines a bijection 

Kn,q : J{¥g)/nJ{¥q) ^ J[n](Fg) = J[n]. 

We now assume that 

n = l'' 

is a power of some prime integer I ^ p. We still make the (strong !) assump- 
tion that J[n] splits completely over F^. We want to compute the Kummer 
map Kn^q explicitly. Let P be an F^ -rational point in J. Let R be such that 
nR = P. Since Fq — \ annihilates J[n], there is an F^-endomorphism k of 
J such that Fq-\ = uk. We note that k belongs to Z[F<j] (»z Q = Q[-^g] 
and therefore commutes with Fq. We have 

<P) = {Fq-\){R)=K^,q{P) 

and k(-P) is F^-rational. So we can compute Kn,q{P) without computing 
R. We don't need to divide P by n. 

The Kummer map will show very useful but its definition requires that 
J[n] splits completely over F^. If this is not the case, we must base change 
to some extension of F^. 

Let x(x) be the characteristic polynomial of Fq and let B = Hil^"^* ~ 1) 
where the fi are the degrees of the irreducible factors of x(x) mod I. Let 
P be the smallest power of I that is bigger than or equal to 2g. Let 
Cfe = p+'^-i and Ak = BCk. Set Q = q^''. From Lemma 13.4.1 there is a 
polynomial {x) such that 

Fq = 1 + I'^MkiFq). 
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So for P an FQ-rational point in J and R such that nR = P, the Kummer 
map Kn^Q applied to P is 

Mk{F,){P) = {Fq - 1){R) = Kn,Q{P) 

and this is an FQ-rational point. 

13.5.2 Lemma (Computing the Kmnmer map) Let J/F^ be a jacobian. 
Let g > 1 be its dimension. Let I ^ p be a prime integer and n = 
a power of I. Let x(x) be the characteristic polynomial of Fq and let 
B = Yli{l-^^ — 1) where the fi are the degrees of the irreducible factors 

ofx{x) mod I. Let P be the smallest power of I that is bigger than or equal 
to 2g. Let Ck = H+'^'^i and A^. = BCk- Set Q = and observe that n 
divides Q — 1 because J[n] splits completely overFg. There exists an endo- 
morphism k G 1'[Fq] of J such that nn = Fq — 1 and for every Fq-rational 
point P and any R with nR = Pone has k{P) = {Fq-1){R) = Kn,Q{P). 
This endomorphism k induces a bijection between J{¥Q)/nJ{¥Q) and 
J[n](FQ) = J[n]. Given x{x) and a positive integer N one cm compute 
K mod N as a polynomial in Fq with coefficients in 'L/N'L in probabihstic 
polynomial time in g, log log q, k, log N. 

This lemma is not of much use in practice because the field Fq is too big. 
On the other hand, we may not be interested in the whole n-torsion in J but 
just a small piece in it, namely the n-torsion of a given divisible group. 

So let Z / p be a prime integer and G an /-divisible group in J[l°°]. Let 

n G End( J/Fg) (g)z I^i 
be a projection onto G. So 

n : J[l°°] ^ G. 

We assume that 11^ = H. Let n = and let Q be a power of q such that 
G[n] splits completely over Fq. Let P be an FQ-rational point in G. Let 
i? G G(Fq) be such that nR = P. We set 

KG,n,Q{P) =^'^R-R 

and define an isomorphism 

KG,n,Q ■ G(FQ)/nG(FQ) ^ G(FQ)[n] = G[n]. 
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In order to make this construction exphcit, we now assume that there 
exists some k eZi [Fq] such that 

{Fq-1- nK)U = 0. 

Lemma 13.4.4 provides us with such a Q and such a k when G = J[l°° , Fq] 
is some characteristic subspace. 

We now can compute this new Kummer map K(Q^n,Q- Let P be an ¥q- 
rational point in G. Let i? G G be such that nR = P. From 

{Fq-1- nK)U{R) = = (Fq - 1 - nK){R) 

we deduce that KQ^n,Q{P) = ^^{P)• Hence the following lemma. 

13.5.3 Lemma (The Kummer map for a divisible group) Let J/Fg he a 
jacobian. Let g be its dimension. Let I ^ pbe a prime integer and n = 
a power of I. We assume that g > I. Let x(x) be the characteristic poly- 
nomial of Fq. Assume that x(x) = F{x)G{x) mod I with F and G monic 
coprime polynomials in [x] and let Gp be the associated divisible group. 
Let B = ni(^''^* ~ 1) 'where the fi are the degrees of the irreducible fac- 
tors of F{x) mod /. Let P be the smallest power of I that is bigger than 
or equal to 2g. Let Ck = and Ak = BCu- Set Q = q"^"^ From 

Lemma 13.4.4 there exists an endomorphism k G '^i[Fq] such that 

UpiriK - Fq + 1) = 

and for every Fq-rational point P & Gp and any R e Gp with nR = P 
one has 

K{P) = {FQ-l)iR)=KG,n,Q{P)- 

This endomorphism k induces a bijection between Gi?(FQ)/nGi7'(FQ) and 
Gi;'[n](FQ) = Gffn]. Given x{x) and F{x) and a power N of I, one 
can compute k mod N as a polynomial in Fq with coefficients in Z/NZ in 
probabilistic polynomial time in g, log I, log q, k, log N. Any N > n(4Q)^ 
suffices for the purpose of computing k{P). 
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13.6 LINEARIZATION OF TORSION CLASSES 

Let C be a degree d plane projective absolutely integral curve C over ¥q 
with geometric genus g> I, and assume that we are given the smooth model 
X of C. We also assume that we are given a degree 1 divisor O = — 0~ 
where O"*" and 0~ are effective, F^-rational and have degree bounded by 
0(7® for some constant 0. 

Let J be the jacobian of X. We assume that / / j3 is a prime integer that 
divides # J(F<j). Let n = l^hQ a power of I. We want to describe J(¥q) [r] 
by generators and relations. 

If xi, X2, . . . , X/ are elements in a finite commutative group G we let TZ be 
the kernel of the map C-.Z^ defined by ^(ai, • • • ,ai) =J2i 

ttiXi. We 

call TZ the lattice of relations between the Xj. We first give a very general and 
rough algorithm for computing relations in any finite commutative group. 

13.6.1 Lemma (Finding relations in blackbox groups) Let G he a Unite 
and commutative group and let x\, X2, xj be elements in G. A basis 
for the lattice of relations between the Xj can be computed at the expense of 
SI^^G operations (or comparisons) in G. 

We first compute and store all the multiples of xi. So we list 0, xi, 2xi, 
. . . until we find the first multiple eixi that is equal to zero. This gives us the 
relation ri = (ei, 0, . . . , 0) G TZ. This first step requires at most o = #G 
operations in G and o comparisons. 

We then compute successive multiples of X2 until we find the first one 
62X2 that is in Li = {0, xi, . . . , (ei — l)xi}. This gives us a second relation 
r2. The couple (ri, r2) is a basis for the lattice of relations between xi and 
X2. Using this lattice, we compute the Ust L2 of elements in the group 
generated by xi and X2. This second step requires at most 2o operations 
and 6162 < o comparisons. 

We then compute successive multiples of X3 until we find the first one 
63X3 that is in L2. This gives us a third relation r-^. The triple (ri, r2, ra) is 
a basis for the lattice of relations between xi, X2 and X3. Using this lattice, 
we compute the list L3 of elements in the group generated by xi, X2 and X3. 
This third step requires at most 2o operations and comparisons. And we 
go on Uke this. □ 
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We stress that the algorithm above is far from efficient and will not be 
very useful unless the group G is very small. 

We now come back to the computation of generators and relations for 
J{^q)[l% Let S = Z - 1. Let P be the smallest power of / that is bigger 
than or equal to 2g and let = BP^^^^. We set Qk = Let F be the 
largest power of x — 1 dividing the characteristic polynomial x(a^) of Fq. 
Definition 13.4.3 and Lemma 13.5.3 provide us with two surjective maps 

Hi: J(FQjr]^Gi(FQj 

and 

If we now take for F the largest power oi x — q dividing x(x), Defini- 
tion 13.4.3 and Lemma 13.5.3 give two surjective maps 

n, : J(FQjr] ^ G,(FqJ 

and 

Kg,,i^q, ■■ <G.(FqJ ^ Gq[l% 

Remember that = and the restriction of the Weil pairing to 
Gi[/'^] X GgfZ*^] is non-degenerate. We use this pairing to build a presenta- 
tion for Gi[Z^] and Gg[Z'^] simultaneously. The motivation for this approach 
is that generators for Gi[Z'^] provide relations for Gq[/^], and conversely. 

If Qk > 4(7^ » we use Lemma 13.2.4 to produce a sequence 71, . . . , 7/ 
of elements in J{¥q^_) that generate (with high probability) a subgroup of 
index at most 

i = max(485, 24o?, 720). 

If Qk < ^9^ we use Lemma 13.2.1 to produce a sequence 71, . . . , 77 of 
elements in J{¥q^,) that generate it. 

Let be the largest divisor of #J(Fq^) which is prime to I. 
We set 



«i = -f^Gl,^^Q,(^l(A^7^)) 
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and 

A = ^G„^^Q.(^,(iV7.)). 

The group Ak generated by the CKj has index at most l in GifZ'^]. The 
group Bk generated by the Pi has index at most l in Gg [Z'^] . Let be smallest 
power of I that is bigger than l and assume that k > S. Then 

We now explain how to compute the lattice of relations between given 
elements pi, pj in We denote by TZ this lattice. We recall that 

the restriction of the Weil pairing to GifZ*^] x Gq[l'^] is a non-degenerate 
pairing 

We fix an isomorphism between the group 

Hiking) = /X,fc(FQj 

of roots of unity and Tj/I^Tj. Having chosen the preimage of 1 mod l^, 
computing this isomorphism is a problem called discrete logarithm. We can 
compute this discrete logarithm by exhaustive search at the expense of 0{l^) 
operations in Fq^. There exist more efficient algorithms, but we don't need 
them for our complexity estimates. 

We regard the matrix (e^fc {pj , /Jj)) as a matrix with / rows, J columns and 
coefficients in 'L/l^'L. This matrix defines a morphism from Z'^ to {'L/I^'LY 
whose kernel is a lattice 7l! that contains TZ. The index of TZ in Tl! is at 
most i. Indeed TZ' /TZ is isomorphic to the orthogonal subspace to inside 
< pi,. . . ,pj >C Gi[Z'^]. So it has order < i. We then compute a basis 
of TZ'. This boils down to computing the kernel of an / x {J + I) integer 
matrix with entries bounded by l^. This can be done by putting this matrix 
in Hermite normal form (see [Coh, 2.4.3]). The complexity is polynomial 
in /, J and fc log/. See [Hav], [Coh, 2.4.3] and [Kal]. 

Once given a basis of TZ', the sublattice TZ can be computed using 
Lemma 13.6.1 at the expense of < 3 Ji operations. 

We apply this method to the generators {ai)i of Ak- Once given the lattice 
TZ of relations between the ai it is a matter of linear algebra to find a basis 
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(61, ... , hw) for Ak\l^^^] = Gi\l^^^\. The latter group is a rank w free 
module over TLll^~^TL and is acted on by the g-Frobenius Fq. For every 6j 
we can compute the lattice of relations between Fq(bj), bi, 62, . . . , 6«, and 
deduce the matrix of Fq with respect to the basis {hi, . . . ,bw). From this 
matrix we deduce a nice generating set for the kernel of — 1 in Gi . 
This kernel is J[l''-^]{¥q). We deduce the following. 

13.6.2 Theorem (Computing the /^-torsion in the Picard group) There 
is a probabilistic Monte-Carlo algorithm that on input 

1. a degree d and geometric genus g plane projective absolutely integral 
curve C over ¥q, 

2. the smooth model X ofC, 

3. a degree 1 divisor O = — O" where 0+ and 0~ are effective, ¥q- 
rational and have degree bounded by 65® for some positive constant 

e, 

4. a prime I different ffom the characteristic p of¥q and a power n = 
ofl, 

5. the zeta ffmction of X, 

outputs a set gi, . . . , gi of divisor classes in the Picard group of X/¥q, such 
that the -torsion Pic{X/¥ q)[l''] is the direct product of the < gi >, and 
the orders of the gi form a non-decreasing sequence. Every class gi is given 
by a divisor Gi — gO in the class, where Gi is a degree g effective ¥q-divisor 
onX. 

The algorithm runs in probabilistic polynomial time in d, log q and l^. It 
outputs the correct answer with probability > i. Otherwise, it may return 
either nothing or a strict subgroup ofFic{X/¥q)[l^] . 

If one is given a degree zero ¥q-divisor D = — D~ of order dividing 
l^, one can compute the coordinates of the class of D in the basis {gi)i<i<i 
in polynomial time in d, log q, and the degree of D^. These coordinates 
are integers Xi such that Ylri<i<i ^i9i = i^]- 
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13.7 COMPUTING Vf MODULO p 

In this section, we apply the general algorithm given in Section 13.6 to the 
plane curve Ci constructed in Section 12.3.3 and we compute Ramanu- 
jan divisors modulo p. So we assume that we are given an even integer 
/c > 2, a prime integer / > 6(A; — 1), a finite field F with characteris- 
tic /, and a ring epimorphism / : T(1,A;) — F. More precisely, we are 
given the images /(Tj) for i < k/12. We want to compute the associ- 
ated Galois representation Vf c Ji(/) or rather its image Wj C Ji(5/) by 
B^i I ^ : Ji{l) Ji(5Z). We will assume that the image of pf contains 
SL(V/). We set Xi = Xi{5l) and Ji = Ji{l) and we denote by gi the genus 



Let p {5, /} a prime integer. We explain how to compute divisors on 
Xi /¥p associated to every element x in Wf /¥p C J/Fp. The definition field 
¥q for such divisors can be predicted from the characteristic polynomial of 
the Frobenius endomorphism Fp acting on Vf. So the strategy is to pick 
random F^-points in the Z-torsion of the jacobian Ji and to project them 
onto Wf using Hecke operators. 

The covering map B^i^i^i : Xi — )• Xi(l) has degree 24. We call it tt. It 
induces two morphisms vr* : Ji{l) — )■ Ji and vr* : J/ — Ji{l) such that 
the composite map vr* o vr* is multiplication by 24 in Ji{l). We denote by 
Ai C Ji the image of vr*. This is a subvariety of Ji isogenous to Ji{l). 
The restriction of tt* o tt* to Ai is multiplication by 24. The maps vr* and 
TT* induce Galois equivariant bijections between the iV-torsion subgroups 
Ji (Z) [N] and Ai [N] for every integer N which is prime to 6. 



Using Theorem 2.5.12 we derive from / a finite set {ti,... ,tr) of ele- 
ments in T{1, 2) with r = {l^ - l)/6 and 



and Wf C Ai C Ji is the image of Vf by tt*. 

We choose an integer s such that 24s is congruent to 1 modulo I. For 
every integer n > 2 we note T„ G T(Z, 2) the n-th Hecke operator with 
weight 2 and level I. We can see T„ as endomorphism of Ji(Z). We set 



ofXi. 




(13.2) 



l<i<r 
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fn = [s] o TT* o r„ o TT*. We notice that 

f„o7r* = 7r*or„ 

on Ji (/)[/]. This way, the map vr* : Ji(/) — )■ J/ induces a Galois equivariant 
bijection of T(^, 2)-modules between Ji{l)[l] and Ai[l\. And W"/ = 7r*(V/) 
is the subspace in Ai\l\ cut out by all — r(n). We notice that tt*, tt*, 
r„, and Tn can be seen as correspondences as well as morphisms between 
jacobians. The following lemma states that the Hecke action on divisors can 
be efficiently computed. 

13.7.1 Lemma (Computing the Hecke action) Let I and p be primes such 
that p {5, 1}. Let n > 2 be an integer. Let q be a power of p and let 
D be an effective ¥q-divisor of degree deg(L') on Xi mod p. The divisor 
TT* OTT* (D) can be computed in polynomial time in I, deg(D) and log q. The 
divisor tt* o r„ o 7r*(D) can be computed in polynomial time in I, deg{D), 
n and log q. 

If n is prime to /, we define the Hecke operator T{n,n) as an ele- 
ment in the ring of correspondences on Xi{l) tensored by Q. See [Lan4, 
Vn, §2 ]. From [Lan4, VH, §2, Theorem 2.1] we have = {Tif and 
T^i = T^i-iTji — nT^i-2T{n,n) if n is prime and n ^ I. And of course 
TniTn2 = Tn^n2 if ^1 ^nd 77,2 are coprime. So it suffices to explain how to 
compute Ti and also T„ and T{n, n) for n prime and n ^ I. 

Let X = {E, u) be a point on Yi{l) C Xi{l) representing an elliptic curve 
E with one i-torsion point u. Let n be an integer. The Hecke operator 
maps X onto the sum of all (i?/, I{u)), where I : E ^ Ej runs over the 
set of all isogenics of degree n from E such that I{u) still has order I. If 
n is prime to I, the Hecke operator T{n, n) maps x onto 4j times {E, nu). 
So we can compute the action of these Hecke correspondences on points 
X = {E, u) using Vein's formulae [Vel]. 

There remains to treat the case of cusps. 

We call <Ty3 for 1 < /3 < ^ the cusp on Xi {I) corresponding to the i-gon 
equipped with an Z-torsion point on the ^S-th component. The corresponding 
Tate curves C*/g have an Z-torsion point w = QqT where the star runs over 
the set of all residues modulo I. There are I Tate curves at every such cusp. 
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We call /Vq for 1 < a < ^ the cusps on Xi{l) corresponding to a 1-gon 
equipped with the /-torsion point in its smooth locus Gm- The Tate curve 
at fia is the Tate curves C*/q with Z-torsion point u; = One single Tate 
curve here: no ramification. 

For n prime and Iv/e have 



and 

where na in /x„q, (resp. nP in Gnp) should be understood as a class in 

(z//z)7{i,-i}. 

Similarly 



and 



And of course, if n is prime to I, then 



T{n,n){ap) = ^<^n0 



and 



All together, one can compute the effect of T„ on cusps for all n. For the 
sake of completeness, we also give the action of the diamond operator (n) 
on cusps. If n is prime to I then {n){ap) = and {n){iJ.a) = iJ-na- 

□ 

We can now state the following theorem. 

13.7.2 Theorem (Computing Vj modulo p) There is a probabilistic (Las 
Vegas) algoritbm that takes as input an even integer k > 2, a prime inte- 
ger I > 6{k — 1), a Unite Geld F with characteristic I, a ring epimorphism 
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/ : T(l, A;) — > F, a cuspidal divisor Q. on Xi{bl) as constructed in Sec- 
tion 8.1, and aprimep {5, /}, and computes thereduction modulop of ev- 
ery element in Wf C Ji(5/). HereVf C Ji{l) is defined by Equation (13.2) 
and Wf the image ofVf C Ji{l) by B^^ ^ ^, and we assume that the image 
of the Galois representation pf associated with f contains SL(V/). The al- 
gorithm returns for every element x in Wf a degree g effective divisor Qx.p 
on Xi (51) /¥p such that Qx.p — ^ lies in the class represented by x modulo 
p. The running time of the algorithm is < {p x ^Vf)^ for some absolute 
constant Q. 



Remark. It has been proven in Section 8.1 that the divisor on Xi (5Z)/Q 
associated to a; G Wf C Ji(5Z)(Q)[Z] is non-special. According to 
Lemma 12.12.2 and Theorem 1 1.7.10, for every prime p but a finite number 
bounded by /®, the divisor remains non-special modulo p for every x in 
Wf, and is equal to the divisor Qx,p returned by the algorithm above. 

To prove Theorem 13.7.2 we notice that Section 12.3.3 gives us a 
plane model for Xi mod p and a resolution of its singularities. From 
Lemma 12.3.6 we obtain the zeta function of Xi mod p. The character- 
istic polynomial of Fp acting on the 2-dimensional F-vector space Vf is 
_ f{Tp)X + mod I. Since we know /(T^ f or 2 < i < k/12 we 
deduce f{Tp) using Manin-Drinfeld-Shokurov theory. Knowing the char- 
acteristic polynomial of Fp, we deduce the order of Fp acting on Vf mod p. 
We deduce some small enough splitting field ¥g for Vf mod p. We then ap- 
ply Theorem 13.6.2 and obtain a basis for the /-torsion in the Picard group 
of Xi/¥q. The same theorem allows us to compute the matrix of the endo- 
morphism vr* o tt* in this basis. We deduce a F; -basis for the image A[l] (Fg) 
of TT* o TT*. Using Theorem 13.6.2 again, we now write down the matrices 
of the Hecke operators r„ in this basis for all n < (/^ — l)/6. It is then a 
matter of Unear algebra to compute a basis for the intersection of the kernels 
of all (ti)i<j<(z2_i)/e in ^[Z](Fg). The algorithm is Las Vegas rather than 
Monte-Carlo because we can check the result, the group Wf having known 
cardinality (#F)2. □ 
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Computing the residual Galois representations 

B. Edixhoven 

In this chapter we first combine the results of Chapters 1 1 and 12 in order 
to work out the strategy of Chapter 3 in the setup of Section 8.2. This gives 
the main result, Theorem 14. 1 . 1 : a deterministic polynomial time algorithm, 
based on computations with complex numbers. The crucial transition from 
approximations to exact values is done in Section 14.4, and the proof of 
Theorem 14.1.1 is finished in Section 14.7. In Section 14.8 we replace the 
complex computations with the computations over finite fields from Chap- 
ter 13, and give a probabilistic (Las Vegas type) polynomial time variant of 
the algorithm in Theorem 14.1.1. 

14.1 MAIN RESULT 

For positive integers k and n we have defined, in Section 2.4, T(n, k) 
as the Z-algebra in Endc(5'fc(ri(n))) generated by the Hecke opera- 
tors Tm (m > 1) and the (a) (a in (Z/nZ)^). Theorem 2.5.10 says 
that T(n, k) is generated as Z-module by the Hecke operators Tj with 
1 < i < A:-[SL2(Z) : ri(n)]/12. In particular, T{l,k) is generated 
as Z-module by the Tj with i < A;/ 12. For each k and n, each sur- 
jective ring morphism T(n, A;) — > F gives rise to a Galois representation 
Pm-- Gal(Q/Q) ->• GL2(F). Theorem 2.5.18 says that if n = 1 and the 
characteristic I of F satisfies I > 6{k — 1), then is reducible, or has 
image containing SL2(F). 

14.1.1 Theorem There is a deterministic algorithm that on input a positive 
integer k, a finite Geld F, and a surjective ring morphism f : T(l, A;) ^ F 
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such that the associated Galois representation p: Gal(Q/Q) — > GL2(F) is 
reducible or has image containing SL2(F), computes p in time polynomial 
in k and #F. The morphism f is given by the images of Ti,. . . , T^k/i2} ■ 
More explicitly, the algorithm gives: 

1. a Galois extension K of Q, given as a Q-basis e and the products CiCj 
(i.e., the aij^k in Q such that e^ej = J2k '^i,j,kek are given); 

2. a list of the elements a of Gal{K/Q), where each a is given as its 
matrix with respect to e; 

3. an injective morphism p from Gal(K/Q) into GL2(F), making F^ 
into a semi-simple representation of Gal(Q/Q), 

such that K is unramified outside I, with I the characteristic of F, and such 
that for all prime numbers p diiferent Irom I we have: 

trace(p(Probp)) = f{Tp) and det(p(Probp)) = /"^ in F. 

14.1.2 Remark Of course, we do not only prove existence of such an algo- 
rithm, but we actually describe one in the proof. We cannot claim that we 
really give such an algorithm because we did not make all constants in our 
estimates exphcit, e.g., those in Theorem 11.7.6 and Theorem 11.7.10. 

Proof As this proof is rather long, we divide it into sections. 

14.2 REDUCTION TO IRREDUCIBLE REPRESENTATIONS 

Let k, F, / and / be as in Theorem 14.1.1. By definition, the associated 
representation p: Gal(Q/Q) — ^ GL2(F) is semi-simple, unramified out- 
side {1} and has detop = xf"\ with xi- Gal(Q/Q) ¥f the mod I 
cyclotomic character. Hence p is reducible if and only if it is of the form 
xl © for some i and j in Z/(/— 1)Z with i+j = k—l in 
The following result gives us an effective way to decide if p is reducible, 
and to determine p in that case. More precisely, using the standard algo- 
rithms based on modular symbols this proposition reduces the proof of The- 
orem 14.1.1 to the case where p is irreducible. 
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14.2.1 Proposition In this situation, if I = 2, then p = 1 ® 1, and if I = 3, 
then p = l(B X3- Assume now that I > 5. Let i and j be in Z/ (i— 1)Z such 
that i + j = k—1. Then p is isomorphic to x\ ® xj if ^nd only if for all 
prime numbers p ^ I withp < {P—l)/12 we have f{Tp) = p^+p' in F. 

Proof The statements about 1=2 and ^=3 are proved in Theoreme 3 
of [Ser4] (see also Theorem 3.4 of [Edil]). As T(l, k) is not zero (it has 
F as quotient), k is even. 

The idea for the rest of the proof is to use suitable cuspidal eigenforms 
over F; whose associated Galois representations give all the Xi®xi with 
i+j odd, and then to apply Proposition 2.5.16. 

For a in Z even such that 4 < a < 3 or a = let be the element 
of Mail, ¥i) with ai(Ea)=l and Tp(Ea) = (l+p""^)^a for all primes p. 
These Ea can be obtained by reducing the Eisenstein series Ea modulo /, 
after multiplication by Bk/2k (see Example 2.2.3). We cannot use Ei_i 
because its reduction has constant g-expansion 1, and so it cannot be nor- 
malised as we need. The Eg, are eigenforms, and we have p^^ = 1©%""^. 
We note that the x"~^ give all powers of xi except x^^- But we do have 

1 © xi^ = Xi^ ® f^i+i' ^^^^ ^^'^^ O^^^Ea 
give the same Galois representation. Therefore, all Xi®x\ with i+j odd are 
associated with suitable cupsidal eigenforms. The proof is then finished by 
invoking Proposition 2.5.16. □ 

14.3 REDUCTION TO TORSION IN JACOBIANS 

Let k, F, I and / be as in Theorem 14.1.1, such that the representation p 
attached to / is irreducible. The following proposition is a special case of 
Theorem 3.4 of [Edil]. 

14.3.1 Proposition In this situation, there is a k' in Z>o and a surjec- 
tive ring morphism /': T(1,A;') — > F and an i in Z/(/— 1)Z such that 

2 < k' < l+l and p ^ p' ® xl where p' : Gal(Q/Q) ^ GL2(F) is 
the Galois representation attached to f. 

Such ak', f and i can be computed in time polynomial in k and I as fol- 
lows. First, one computes the F;-algebras F; (g) T(l, k') for 2 < k' < l+l. 
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Then, for each iinZ/(^— 1)Z and for each k' , one checks if there exists an 
Fi-hnear map from F/ ® T(l, k') to F that sends, for all m < {f-l)/l2 
with I not dividing m, Tm to m~^f{Tm), and if so, if it is an algebra mor- 
phism. The previous proposition guarantees that such k', f and i do exist. 
Proposition 2.5.16 guarantees that p = p' ® x\- 

Using standard algorithms for linear algebra over Q, the computation of 
p is reduced to that of p' . By Theorem 2.5.12, /)' is realised in Ji(/)(Q)[^] as 
the intersection of the kernels of a set of elements of (g) T(/, 2) that can be 
computed in time polynomial in k and I . Hence, the proof of Theorem 14.1.1 
is reduced to the case where p is irreducible, and is reaUsed in Ji(/)(Q)[^] 
as described in Theorem 2.5.12. 



14.4 COMPUTEVG THE Q(0)-ALGEBRA CORRESPONDING TO V 

We recall the situation. The representation p of Gal(Q/Q) attached to the 
surjective ring morphism f\: T(l, /c) — F has image containing SL2(F), 
and is also attached to a surjective ring morphism /2 : T(2, /) — F. In par- 
ticular, p is realised on the two-dimensional F- vector space V in Ji(Q(Q)[/] 
consisting of all elements annihilated by ker(/2). We note that Z > 5. As 
in Section 8.2 we let Xi be the modular curve Xi(5Z), over Q, and we em- 
bed F in the Jacobian Ji of Xi via puUback by the standard map from Xi 
to Xi{l). We take a cuspidal divisor Dq on X; q(|Jj) as in Theorem 8.1.7. 
We have, for each x G F, a unique effective divisor Dx of degree gi (the 
genus of Xi) on X^ q, such that in Ji{Q) we have x = [Dx — Dq]. We write 
each Dx as + Dx^^, where Dx^'^^ is supported on the cusps and Dx^ 
is disjoint from the cusps. We write Dx = J2f=i Qx,u with Qx,i in Xi{^), 

such that L>f = Ef=i Qx,i. 
Theorem 12.10.2 says that we have an analytic description of V inside 

Ji{C), and, that for every embedding a: Q(C/) — ^ C, complex approxima- 
tions Da-^x of the Dx can be computed in polynomial time in and the 
required accuracy (the number of digits on the right of the decimal point). 
Each such approximation is given as a sum of gi points Qa,x,i in Xi{C), the 
numbering of which by i G {1, • • • ,9i} is completely arbitrary, i.e., unre- 
lated to each other when a varies. Similarly, complex approximations of all 
h{Qx,i) or 0-/h){Qx,i) (one of which two has absolute value < 2) and of 
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all x'i{Qx.i) or j) can be computed in polynomial time in #F and 

the required accuracy. We denote such approximations by bi{Qcr,x,i), etc. 

We compute such approximations, and also of j{Qx,i) or {l/j){Qx,i)< 
for all (T, X and i, with accuracy a sufficiently large absolute constant 
times Z^^ (#F)^. Here, and the rest of this section, we will use the O- 
notation without making the implied "absolute" constants explicit. 

Using these approximations we will first decide for which {a, x, i) the 
point Qcr,x,i approximates a cusp or not. For x = we have = Dq 
and so all Qo.i are cusps. Recall that the cusps are precisely the poles 
of the rational function j. Hence a necessary for Qa,x,i to approxi- 
mate a cusp is that {l/j){Qa,x,i) is small. Let x in F be non-zero, 
and i in {1,...,^;} such that j{Qx,i) 0- Proposition 11.7.1, 
the expression for j in b in Proposition 8.2.8, and Lemma 4.2.3, we 
have h{{l/j){Q.^^,)) = 0{l^^). The degree of (l/j)(<5x,i) over Q is at 
most /2.(^]p)2 gy Lemma 4.2.5, we have, for all cj: Q C, that if 
/ 0,then > ^M-0{l'\W?)). We con- 

clude that the Q,,^,i for which j){Q„,^,i))\ < exp{-0{l^\#¥)^)) 
are the ones that approximate cusps. This gives us the correct value 
of the integers dx, and, after renumbering the Qa,x,u approximations 
^'". = EtiQ<^,-,^ofthei^fi°. 

The next step is to get an integer n with < n < Z^-(#F)'' such 
that the function fi := hi + nx'^ separates the various Q^^i with x ^ V 
and i < dx that are distinct. We do this using just one embedding a 
of QiCi) iri C. For x in V and i < dx v/e have, by Proposition 11.7.1, 
h{{bi{Qx,i): x'i{Qx,i))) = 0(/^^). For x and y in V, the field over 
which they are both defined has degree at most Z (#F)^ over Q. By 
Lemma 4.2.5, we conclude that Qa,x,i and Qa,y,j approximate the same 
point if and only if \bi{Qa,x,i) - bi{Qa,y,j)\ < exp{-0{l^^i#¥)^)) 
and \x'i{Q„^x,i) - x'i{Qa,yj)\ < cxp(-0(/i3-(#F)-^)). We observe 
that the required approximations can indeed be computed within the re- 
quired time because the height bounds from Proposition 11.7.1 imply that 
\bi iQa,x,i)\ < (#F)^)), i.e., also on the left of the decimal point there 

are not too many digits. An integer n as above does not give a suitable fi if 
and only if there are Qa,x,i and Qa,y,j that approximate different points and 
still \fi{Qa,x,i) - fi{Qa,y,j)\ < exp(-0(Zi3.(#F)3))). Trying the possible 
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n one by one until we have a suitable one gives us a function fi as desired. 

Now that we have our function fi, we continue, as explained at the end of 
Section 8.2, by computing an integer m with < m < ^^•(#F)^ such that 
the function: 

am-.V ^Q, x^Y\{m- fi (Q^,^)) 
1=1 

is injective, and hence a generator of the Q(C;)-algebra ^q(^,) corre- 
sponding to F. As in the previous step, we do this using just one em- 
bedding cr of Q(0) in C. We estimate the loss in accuracy in com- 
puting a product Yli^^^im - fi{Qa,x,i))- For x in F and i < 
we have h{fi{Qx,i)) = 0{l^'^). Hence, in the product, we have 
\fl{Q(T,x,i)\ = 0{l^^-{#¥f ). As there are at most l"^ factors, the loss 
of accuracy is at most 0(/^^-(#F)^) digits. Hence, from our approx- 
imations fi{Qa,x,i) we get approximations aa,m{x) of the a^(x) with 
accuracy 0{l^^-{#¥)^). For all candidates m and all x in V, that 
h{am{x)) = 0{l'^^), and the degree of am{x) over Q is at most (#F)^. We 
conclude that a candidate m is not suitable if and only if there are distinct x 
and ymV with \aa^m{x) - a<7,m(y)| < exp(0(-/^'^-(#F)2)). Trying one 
by one gives us a suitable m. 

We denote by a = aoaji^m the generator of ^Q(f,) that we obtained by 
finding suitable n and m. We will now compute the minimal polynomial 
of a over Q(0): 

(14.4.1) P=J[{T-a{x)), P = Y^P^T\ PjeQiQ). 

As h{a{x)) = 0(/^^), and, for j in {0, . . . ,#V}, Pj is, up to a sign, 
an elementary symmetric polynomial in the a{x), Lemma 4.2.4 gives that 
h{Pj) = 0(/i4-(#F)2). We write the Pj in the Q-basis (1,0, • • -Xt^) 
ofQ(O): 

i<l-l 

Then, for each j, {Pj,o, ■ ■ ■ , Pj,i-2) is the unique solution in Q of the system 
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of linear equations, indexed by the a in Gal(Q(Ci)/Q)- 

i<l-l 

Applying Lemma 4.2.6 and Cramer's rule give: 

(14.4.2) hiPj,i) < l\ogl + l-h{Pj) = 0{l^''i#¥f). 

So, in order to deduce the Pjs from approximations as in Proposi- 
tion 3.2 the accuracy we need is 0(/^^-(#F)^). We estimate the loss 
of accuracy in the evaluation of the product in (14.4.1). We already 
know that h{a{x)) = 0{l^^), and that the degree of a{x) over Q 
is (#F)^. Therefore, for all embeddings a of Q(Ci) into C, we have 
\a^{x)\ = exp(0(/i4-(#F)2)). As there are (#F)2 factors in (14.4.1), the 
loss of accuracy is at most 0(Z^^-(#F)^)). We conclude that our approxi- 
mations Pa = Ylxevi^ ~ cI(t{x)) at all a are accurate enough to get good 
enough approximations of the j such that Proposition 3.2 gives us the 
exact values of the Pj^i. So, finally, we know ^q(^;) explicitly as: 

^Q(co = Q(com/(p)= QiCiyr. 

0<i<(#F)2 

We remark that the definition of a directly imphes that a(0) = 1. Hence 
P has a factor T — 1. Under our assumption that the image of p contains 
SL2(F) the polynomial P/{T - 1) is irreducible over Q(CO- 

14.5 COMPUTING THE VECTOR SPACE STRUCTURE 

The addition map + : V xV ^ V corresponds to a morphism of Q-algebras 
+* : A ^ A A, called co-adition. We will now explain how to compute 
the co-addition over Q(0), i.e., the morphism of Q(0)-algebras: 

+*■■ Mci) Mci) = Qmu,v]/iPiu),p{v)). 

To give this morphism is equivalent to give the image of our generator a of 
the previous section. This image can be written uniquely as a polynomial 
in U and V of degree less than (#F)^ in each variable. Hence, there are 
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unique fiij in Q(0)» for ^ ^i^d J in {0, ... , (#F)^ — 1}, such that for all x 
and y in F we have, in Q: 



We view (14.5.1) as an inhomogeneous system of (#F)^ linear equa- 
tions in the fiij. Then our bound h{a{x)) = 0{l^^), together with 
Cramer's rule and Lemma 4.2.6 give h{iii_j) = 0(/^^-(#F)®). Writing 
^^id = Y.k<i-\l^id,kCf, we have h^dij^k) = 0{l^^-{#¥f). Hence our 
approximations (x) are sufficiently precise to deduce the exact values of 
the //ij,fc. 

We also want to compute the multipUcation map ¥ x V ^ V. That is, 
for each A in F we want to know the map (A )* from ^q(^;) to itself that 
it induces. For A = this is the map that sends a to 1. Let now A be 
in F^. Then there are unique in Q{Ci), for i in {0, ... , (#F)^— 1} such 
that (A-)* (a) = ^jO-a*. These uniquely determined by the following 
equalities in Q, for all xinV: 



Arguments as above for the addition show that our approximations a^ix) 
allow us to get the exact values of the a^. 

14.6 DESCENT TO Q 

At this moment, we finally have to pay the price for working with a divi- 
sor Do on -^iMiCi) -^i itself. We have ^q((^,) = Q(0) <^ 
hence we have a semi-Unear action of Gal(Q(0)/Q) on the Q(0)- 
algebra for r in Gal(Q(0)/Q), A in Q(C/), and x in Aq(^q) we 
have r(Ax) = t{X)-t{x). The Q-algebra A is precisely the subset of ^q(^;) 
of elements of that are fixed by this action. 

In order to understand what the action of Gal((Q(C/)/Q) does with our 
generator a of ^q((^,), we must include the divisor Dq into its notation: 
we will write aoo for it. Then, for each r in Gal(Q(0)/Q) we have 
T{aDo) = cltDq, where arOo is defined as a, but with the divisor Dq re- 



(14.5.1) 




(14.5.2) 
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placed by tDq- For each a: Q(C/) — ^ C, and for each xinV C. Ji{C), we 
have the approximations aa,Do{x) of aDo{x), and aaT,Do{x) of arDo{x). 

We take a generator r of Gal(Q(Ci)/Q) = There are unique Cj in 
Q(0), for z in {0, ... , (#F)2-1}, such that T(a) = Y,i Ci-a'. These are 
uniquely determined by the following system of equalities in Q, indexed by 
the X in F: 

(14.6.1) arDoix) = ^ Ci-aDoixf. 

0<i<(#F)2 

Lemma 4.2.6 impUes that for all i we have h{ci) = 0(/^^-(#F)'^), and 
hence, writing Cj = Z]i<i-i CijC/' H^ij) = 0{l^^-{#¥)^). We conclude 
that our approximations ao-,Do {x) of (x), and acrT,Do {x) of a,-£)o for 
all X and a, are sufficiently accurate to get the exact values of the q. 

Linear algebra over Q gives us then A, in terms of a Q-basis with multi- 
plication table, and with the maps +* : A ^ A^A and (A-)* : A ^ A that 
correspond to the F-vector space structure on V. 

14.7 EXTRACTING THE GALOIS REPRESENTATION 

We finish our computation of the Galois representation p as indicated in 
Chapter 3. We view V x V as Hom][r(F^, F). This gives a right-action 

by GL2(F) on V X V, hence a left-action on A A. This action can be 
expressed in the co-addition and the F^ -action. We let B be the Q-algebra 
corresponding to the subset IsomF(F^, V) of HomF(F^, V). To compute 
B, as a factor of A ^ A, we compute its idempotent, i.e., the element of 
AiSi A that is 1 on IsomF(F^, V) and on its complement, as follows. In 
Mci) = Q(0)[r]/((r - l)Pi) we have the idempotent ai = Pi/Pi(l) 
which, as function on V, is the characteristic function of {0}. Then ai is an 
element of A. Let 02 = 1 — oi in A. Then 02 is the characteristic function of 
F— {0}. We let 03 be the element of Aii^A obtained by taking the product of 
the (7- (02 01), where g ranges through GL2(F). Then is the characteristic 
function of IsomF(F^, V). We compute B = [A ^ A) /{I — as) by linear 
algebra over Q, in terms of a basis with a multiplication table, and with the 
GL2(F)-action. 

We factor the algebra S as a product of fields, using a polynomial time 
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factoring algorithm over Q (see [Le-Le-Lo] and [Len2]). Each factor K of 
B then gives us an explicit realisation of p, as explained in Chapter 3: let 
G C GL2(F) be the stabiliser of a chosen factor K; then G = Gal(i^/Q) 
and the inclusion is a representation from G to GL2(F). This finishes the 
proof of Theorem 14.1.1. □ 



14.7.1 Remark In the factorisation of the algebra B above, our assumption 
that imp contains SL2 (F) implies that the idempotents lie in the sub-algebra 
B*-^ of invariants by the subgroup G of GL2(F) consisting of the g with 
det(y) ak—lth power in F^^ . This subalgebra is a product of copies of Q. 

If F = F;, factoring B can be avoided by twisting p by a suitable power 
of xi- Indeed, p' := p ® Xi~^^'^ has image GL2(F;), and p can then be 
obtained as p' (g) xf''^"^- 



14.8 A PROBABILISTIC VARIANT 

In this section we give a probabilistic Las Vegas type algorithm, based on 
the results of Chapter 13, that computes the representation p as in Theo- 
rem 14.1.1, in probabihstic running time polynomial in k and #F. A nice 
feature of computations over finite fields is that there is no loss of accuracy, 
as in the previous sections where computations with complex numbers were 
used. On the other hand, information obtained modulo varying primes is a 
bit harder to combine, and here the point of view of Galois theory that we 
have taken, relating sets with Galois action to algebras, is very convenient. 

Let /: T(l, fc) — )• F be as in Theorem 14.1.1, as well as I and the rep- 
resentation p: Gal(Q/Q) -> GL2(F). Sections 14.2 and 14.3 apply with- 
out any change. So we can now put ourselves in the situation as in the 
beginning of Section 14.4. Then imp contains SL2(F), p is reahsed on a 
two-dimensional F- vector space in J;(Q)[Z], and for each x'mV there is a 
unique effective divisor Dx of degree gi on ^ such that x = [D^ — Dq] 
in Ji{Q). For each x in V, we write = D^"^ + Dl"^^ as before, with 
= Eti Qx,i and Dx = Efii Q.,i. 

Using Theorem 13.7.2, we try to compute the reductions D^^Wg over suit- 
able extensions of the residue fields of '^[Ci] at successive prime numbers p 
up to c-Z^^-(#F)^, with c a suitable absolute constant, skipping 5 and I. 
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These fields Fg have degree at most l-{^¥)^ over their prime field Fp. 
If some Dx,¥q is not unique, this will be detected by our computations, 
and we throw the corresponding prime p away. By Theorem 11.7.10, at 
most 0(Z^^ (#F)^) primes p are thrown away. For the F-good primes 
p < B, with F-good defined as in Theorem 11.7.10, we then have com- 
puted all Dx,¥q- 

We split each such Dx^v^ in a cuspidal part D'^^^ and a non-cuspidal 
part D^\^. By Theorem 11.7.10, there are at most 0{l'^'^-{#¥f) primes p 
where at some F^, the sum J2xev "^^S ^x^q ^^^^ ^^^"^ '^xev 
as imp contains SL2(F), all dx for x 7^ are equal, but our argument does 
not need this.) This means that we have computed the unordered list of dx- 
We discard the primes p where for some the sum J2xev "^^S ^^^^ 
than J2xev '^x- remaining primes, we have computed the D^^^ for 

all X in V. 

We want an integer n such that fi -.= 1)1 + nx'i separates the D^^. Let p be 
the smallest y-good prime with p > We compute the Dl\ over 

some Fg sip. We view the effective divisor D^^ := J2xev ^x\q ^ closed 
subscheme of Xi^f^. Then fi as above embeds D^^ into A^^ if and only if 
it is injective on the geometric points of D^^ and has non-zero derivative at 
the multiple points of D^^. As the degree of Dp, is at most Z^ (#F)^, this 
excludes at most Z^-(#F)^ elements of Fp, and the algorithms of Chapter 13 
let us compute these in polynomial time. We choose n in {0, ... , /^-(^^F)^} 
such that fi embeds Df^ into Ap^. Then, by Nakayama's lemma, // embeds 
J2xev ^x^ ^^^'^ hence separates the Dx^. 

The next step is to compute an integer m in {0, P-{#¥)'^} such that the 
function: 

i=l 

is injective, and hence a generator of the Q(C;)-algebra correspond- 
ing to V. Let p and F^ be as in the preceding paragraph. For x e V, write 
DxX = Eti Qx,i,Wq- We take m in {0, ... , ^^.(^F)^} such that the el- 
ements nf=i("^ ~ MQxiW )) °f ^9' X e V, are all distinct. Then 
a := ttjn has the desired property. 
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The minimal polynomial P in of a over Q(0) is given as: 

P=lliT-aix)), P = J2PjT', PjeQiCi). 

x^O j 

We have seen in (14.4.2) that, when writing Pj = Pj,iCiy we have 

h{Pj,i) = 0(^^^-(#F)^). Our construction shows that all Pj^i are integral 
at all primes p that are F-good. From the D^\^ that we have computed, we 
get the images of the Pj^i in ¥p, for all p that are y-good, up to c-/^^- (#F)^. 
Proposition 3.7 then gives us the Pj^i. So, at this point, we have computed 
the Q(0)-algebra ^q(^,). 

To compute the F-vector space structure, we proceed as in Section 14.5. 
For each F-good prime p up to our bound c-Z^^-(#F)^, we compute at each 
¥q over p the images in F^ of the Hij from the linear system (14.5.1), 
over ¥q, and then the Hij^k in Fp. Proposition 3.7 and the height bound 
h{iJ.i,j, k) = 0(/^^-(#F)^) give us the /ijj,^. The ctj as in (14.5.2) can be 
computed in similarly, as well as the Cj as in (14.6.1). From here on, the 
computation then proceeds as in Section 14.7. 
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Computing coefficients of modular forms 

B. Edixhoven 

In this chapter we apply the our main result on the computation of Galois 
representations attached to modular forms of level one to the computation of 
coefficients of modular forms. In Section 15.1 we treat the case of the dis- 
criminant modular form, i.e., the computation of Ramanujan's r-function at 
primes. In Section 15.2 we deal with the more general case of forms of level 
one and arbitrary weight k, reformulated as the computation of Hecke oper- 
ators T„ as Z-linear combinations of the Ti with i < k/12. In Section 15.3 
we give an application to theta functions of even, unimodular positive defi- 
nite quadratic forms over Z. 

15.1 COMPUTING r(p) IN TIME POLYNOMIAL IN logp 

We recall that Ramanujan's r-function is defined by the following identity 
of formal power series with integer coefficients: 

xfj(l-x")2^ = ^r(n)x". 

n>l n>l 

15.1.1 Theorem There exists a detenmnistic algorithm that on input a 
prime number p gives t{p), in running time polynomial in logp. 

Proof Deligne has proved in [Dell] and [Del2] that for all prime numbers 
p we have \t{p)\ < 2p^^/^. Therefore, it suffices to compute r(p) mod I 
for all primes Z < x, if the product of these I is at least 4p^^/^. Analytic 
number theory (see for example [Ten], 1.2.6, Corollary 10.1) tells us that we 
can take x = O(logp), hence the proof is reduced to showing that there is a 
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deterministic algorithm that computes r(p) mod I for prime numbers p and I 
in time polynomial in log p and I. Of course, the slightly weaker but much 
more elementary bound |r(p)| = O(n^) in [Miy, Cor 2.1.6] also suffices 
for our purposes. 

We take an algorithm as in Theorem 14.1.1, and we apply it with k = 12. 
We have T(l, 12) = Z, and for each n in Z>i, the element T„ of T(l, k) is 
the integer r(n). We must now show that from the output of the algorithm 
we can compute t{p) mod / deterministically, in time polynomial in logp 
and I. For I prime, we let pi : Gal{Ki /Q)^ GL2 (F;) denote the Galois rep- 
resentation attached to A. As the discriminant of the ring of integers A of Ki 
is a power of I, Theorem 1.4 of [Bu-Le] gives the existence of a determin- 
istic polynomial time algorithm that, given Ki, produces A, given by a Z- 
basis. The maximal order A is preserved by the action of Ga\{Ki/Q). Then 
Gal{Ki/Q) acts on the etale Fp-algebra 'A := A/pA, and Hom(]4,Fp) is a 
Gal(i^;/Q)-torsor. Moreover, A is the product of its finitely many residue 
fields A/m,, where m ranges through the maximal ideals of A. 

We let Frob denote the absolute Frobenius endomorphism of A; it sends a 
to a^, it is an automorphism and it induces the absolute Frobenius automor- 
phism on each of the residue fields. The matrix of Prob can be computed in 
time polynomial in I and logp. 

The Frobenius element am attached to a maximal ideal m of ^ is the 
unique element a of Gal(Ki/Q) that fixes m and induces the absolute 
Frobenius on A/m. For varying m, the am form the Frobenius conjugacy 
class (atp) in Gal{Ki/Q). 

For each a in Gal(K;/Q) we let A^- be the quotient of A by the ideal 
generated by the image of Prob — a. Such an can be computed in poly- 
nomial time. The a in the Frobenius conjugacy class are precisely those a 
for which Aa- is non-zero. We can try the a one by one until we have found 
a (T in the Frobenius conjugacy class. Then we apply the map pi given by 
Theorem 14.1.1 to it, and get an element pi{a) of GL2(F;). The trace of 
/9/((t) is then r(p) mod L □ 
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15.2 COMPUTING T„ FOR LARGE n AND LARGE WEIGHT 

In this section we prove the following two results, for which we first re- 
call some notation. For positive integers k and N we have defined, in 
Section 2.4, T(iV,A;) as the Z-algebra in Endc(5fc(ri(A^))) generated by 
the Hecke operators r„ (n > 1) and the (a) (a in (Z/iVZ)^). By Theo- 
rem 2.5.10, T{N,k) is generated as Z-module by the Hecke operators Tj 
with 1 <i< /c-[SL2(Z) : Ti{N)]/12. Just before (2.4.9) we have defined 
Mk{Ti{N),Z) as the sub Z-module of MkiTi{N)) consisting of the / with 
all ai{f) in Z. 

15.2.1 Theorem One can compute, on input two positive integers k and n, 
and the factorisation of n into prime factors, tlie element Tn of the Hecke 
algebra T(l, k), by computing the Galois representations attached to suffi- 
ciently many maximal ideals of T(l, fc) as in Theorem 14.1.1. The com- 
putation gives Tn as Z-linear combination of the Ti with i < k/12. This 
algorithm is deterministic. For fixed k, it has running time polynomial in 
log n. If the generahsed Riemann hypothesis (GRH) holds for all number 
fields that are quotients of Q (g) T(l, k) 's, then the algorithm has running 
time polynomial in k and log n. 

15.2.2 Corollary Assume GRH. There exists a deterministic algorithm that 
on input the weight k > and the coefficients ai{f) with < i < k/12 of 
a modular form f in (SL2 (Z) , Z), and a positive integer n together with 
its factorisation into primes, computes an{f) in running time polynomial in 
k, logn, and the maximum of the log (1 -I- \ai{f)\) withi < k/12. 

The principle of the proof of Theorem 15.2.1 is first to reduce the computa- 
tion of Tn to that of the Tp for the primes p that divide n, using the identities 
implicit in (2.2.11). For p prime, Tp is computed from its images in suffi- 
ciently many residue fields T(l, k)/m, using the LLL-algorithm for lattice 
reduction. Such an image is computed as the trace of a Frobenius element 
at p of the Galois representation pm attached to m. The Galois represen- 
tation is computed as in Theorem 14.1.1. The problem in doing all this is 
to keep the residue fields small, because the computation of pm takes time 
polynomial in k and #(T(1, k)/m). Here it makes a big difference if one 
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assumes GRH or not. Assuming GRH, there are suffiently many m with 
T(l, k)/m of size polynomial in k and \ogp so that Tp can be reconstructed 
from its images in these T(l, k)/m. If we do not assume GRH, then we 
cannot rule out the possibility that all "small" primes (small in terms of the 
discriminant of T(l, k)) are completely inert in T(l, k). Before we give the 
proof of Theorem 15.2.1, where the details of the algorithm are given, and 
the analysis of the running time, we state and prove some preliminary re- 
sults. Corollary 15.2.2 will be deduced from Theorem 15.2.1, using some 
elementary properties of the Eisenstein series E^, and the interpretation of 
the Z-module S'fe(SL2(Z), Z) as the Z-dual of T(l, k). 
We start with a simple result that is well known. 

15.2.3 Proposition Let k > A be an even integer. Let n = {k — 14)/12 if 
k = 2 mod 12, and n = [k/l2\ otherwise. Ttten T(l, k) is free of rank n 
as Z-module, and the Tj witti 1 < i < n form a Z-basis for T. 

Proof Theorem 2.5.10 tells us that T := T(l, k) is generated as Z-module 
by the Tj with 1 < i < k/12, but we will not use this. What we do use is 
that the pairing: 

Sjfc (SL2 (Z) , Z) X T ^ Z, {f,t)^ai{tf) 

is perfect (see (2.4.9)). What me must show is then that S'jfc(SL2(Z),Z) 
is free of rank n as Z-module, and that the maps Oj: / with 
1 < i < n, form a Z-basis of the dual of S'fe(SL2(Z), Z). As A is g times a 
unit in Z[[q']], we have: 

5fc(SL2(Z),Z) = A-Mfc_i2(SL2(Z),Z). 

According to Swinnerton-Dyer ([Swi, §3]): 

(15.2.4) M(SL2(Z), Z) = Z[E4, A] Ee-Z[E4, A], 

with E4 and A algebraically independent, and Eq = £^4 — 1728 A. It follows 
that S'fc(SL2(Z), Z) is free of rank n. Suitable monomials in E4, A and Eq 
show that (ai, . . . , a„) is a Z-basis of S'jk(SL2(Z), Z)'*'. □ 

We note that we do not absolutely need the previous proposition, because 
from the set of generators Tj with l<z<A;/12as given by Theorem 2.5. 10 
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one can also compute a Z-basis in time polynomial in k, and this is what one 
will probably do in the case of arbitrary level and weight. But in this case 
of level one we have chosen to be more explicit. 

We consider the Hecke algebras T(1,A;) as lattices in the M-algebras 
T(1,A;)k := R (g) T(1,A;). As all are selfadjoint as operators on 
5fe(SL2(Z)) with respect to the Petersson inner product (see Section 2.2), 
all their eigenvalues are real. As the level is 1, all normalised eigenforms are 
newforms; let us write them as /i , . . . , /„, and view them as ring morphisms 
fi : T(l, k) M. Then the map: 

/ : T(l, k)u ^ M", (hit), Ut)), 

is an isomorphism of M-algebras. The trace form on the Z-algebra T(l, A;) 
induces the trace form of the R-algebra R", i.e., the standard inner product 
on M". We equip T(l, k)-^ with the standard volume form, i.e., the one for 
which a unit cube has volume 1. Our first goal is now to get a bound for the 
absolute discriminant of T(l, fc), or, equivalently, over the volume of the 
quotient T(l,fc)]R/T(l,A;). 

15.2.5 Proposition Let k > 12 be an even integer. Then we have: 

logVol(T(l,%/T(l,A;)) = ^ log |discrT(l, fc)| < ^logA;. 

Proof As Ti, . . . , r„ is a Z-basis of T(l, k), we have: 

Vol(T(l, A;)m/T(1, k)) = I det(/(ri), . . . , /(r,))|. 

Using Deligne's bound \ap{fj)\ < Ip^^'^^l'^ of [Del2] as we used the Weil 
bounds in the proof of Lemma 1 1 . 1 . 1 we get: 

|(/(r,)),| = |a.(/,)|<ao(i)zM/^ 
^ ^ ^ < 2.zV2^(fc-i)/2 = s-i'^/^. 

Hence the square of the length of /(Ti) is at most \ni^ . This implies: 

n 

|det(/(ri),...,/(T„))| <n(2-i'/'-V^) =2'^-(n!)'=/2-n"/2. 

i=l 
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Hence: 

log Vol(T(l, k)u/T{l, k)) < nlog2 + I log(n!) + ^ logn 

kn kn k n 

< n log 2 + — log n - — + - + - log n, 

where we have used that logn! < nlogn — n + 1. Simple estimates 
for k > 24 and direct checks in the remaining cases give the result (the 
only non-trivial case being A; = 24, in which case the discriminant equals 
2^32144169. □ 

The next ingredient to be used in our proof of Theorem 15.2.1 comes from 
analytic number theory: an effective prime number theorem for number 
fields, under the assumption of GRH. The effectivity just alluded to means 
that for all real numbers x in a specified interval such as (2, oo) an estimate 
for the number of prime ideals of norm at most x of an arbitrary number 
field K is given, whereas the usual prime number theorem is, for each K, a 
different asymptotic statement. 

15.2.7 Theorem (Weinberger) For K a number Geld and x a real number 
let tt{x, K) denote the number of maximal ideals m of the ring of integers 
Ok ofK with #{OK/m) < x. Forx > 2 in M 7etlix = {1/ logy)dy. 
Then there exists c\ in R such that for every number field K for which GRH 
holds, and for every x > 2 one has: 

\Tr{x,K) -\ix\< ciV^log discr(0;^)x^^'^«-^ ) . 

Weinberger states this result in [Wei4] (it is the lemma on page 181, and 
says that it is proved in more generahty in [Wei3] (probably on page 328, 
just after (4.4)). 

15.2.8 Corollary There exist C2 and C3 in R such that for every number 
Geld K for which GRH holds and for every x in R such that: 

x > C2-(log |discr(OK)|)^-(log(l + log |discr(Oii-)|))^ and 
X > C3-(dimQi^)2-(l + logdimQiC)^ 

we have: 

1 X 

tt{x,K) > 



2 logx 
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Proof Let K be a number field for which GRH holds, and let x € M>2- 
We write dK for |discr(Oi^)| and tik for diniQ K. Then Theorem 15.2.7 
says that: 

7r(x, K) > - iog(c/^x"^) 

> -cix^/2log(fe"^) 
logx 

_ X _ 2 _ ci(logx)(log (Ik) _ ciUKjlogx)'^ 
logx \ X x^/^ x^/^ 

In order to estimate the last term of the previous line, one uses the substitu- 
tions X = and y = nj^z. For the one but last term, one uses x = y^ and 
y = 2ci (log dK)z if 7^ 1. □ 

In order to find an element of T(l, A;) from sufficiently many of its images 
modulo maximal ideals, we will need a lower bound on the length of a short- 
est non-zero vector in the intersection of the maximal ideals. The following 
lemma gives a general, well known lower bound in the context of orders in 
number fields. 



15.2.9 Lemma Let K hea number field, n its dimension as Q-vector space, 
A <Z K an order, i.e., a subring of finite index in ttte ring of integers of K, 
and I C Aa non-zero ideal. We equip := M ® K with the inner product 
induced from the standard inner product on C", where i^iR is embedded in 
C" via all distinct crj : K — > C. We consider A and I as a lattices in K^.. 
Then we have: 

where is the length of a shortest element ofl— {0}. 

Proof Let a; G / be non-zero. Then A-x C I, and we have: 

\xi\--- \Xn\ = \^K/Qix)\ = #{A/A-x) > #{A/I). 
The inequality between geometric and arithmetic mean gives: 

n n 
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Combining the last two inequalities gives: 



x\\ > V^-|N;,/Q(ar)|V" > #(A/7)V", 



which finishes the proof. 



□ 



The next result summarises the standard approach for using the LLL- 
algorithm for the "closest or nearest vector problem". For more details on 
lattice reduction we refer to [Le-Le-Lo], [Len3] and [Coh, §2.6]. 

15.2.10 Proposition Let n > and let L be a free Z-module of finite 
rank n, equipped with a positive symmetric bilinear form b: L x L ^ Z. 

We view L as a lattice in the W-vector space equipped with the inner 
product given by h, and for x in Lr we put \\x\\ := {b{x, .x))^/^. Let L' be 
a submodule of finite index of L, and let /v i (L') be the length of a shortest 
non-zero element of L'. Let t be an element of L such that: 



Let e = (ei, . . . , e„) be an "LLL-reduced basis" of L': if e* = (e*, . . . , e* ) 
denotes the orthogonal R-basis of L]r obtained from e by letting e* be the 
orthogonal projection ofei to the orthogonal complement of the subspace of 
Lk generated by {ej \j<i} (i.e., by the Gram-Schmidt orthogonalisation 
process), and jiij := 6(ej, e*)/6(e*, e*), then we have; 



Then t is the shortest element oft + L', and for any x int + L' we recover 
t as follows: 

• put Xn '■= x; 

• fori going down from n to 1 let Xi-i := Xj — [b{xi, e*)/6(e*, e*)]ej, 
where, for y inQ, [y] denotes the largest of the (one or two) integers 
nearest to y; 

• then t = xq. 



t\\ < 2-("+^)/Vi(i^')- 



l/Wjjl < for 1 < j < i < n, and 




for 1 <i <n. 
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Proof We claim that the orthogonal block: 

5:=|^V*| -l/2<Ai<l/2| 

is a fundamental domain for L' acting on Ljr by translations. Indeed, for 
X in L]K and the Xj as above, xq is in B and x — xq is in V , and more- 
over, B and L^/L' have the same volume, namely Hi Iki II- defin- 
ing properties of an LLL-reduced basis we have, for i in {2, . . . , n}, that 
||e*|p > (l/2)||e*_i||2. Also, as e\ = d, we have ||e^|| > /xi(L'). It 
follows that for all i: 

||e*||>2-(^-i)/2||ei||>2-(^-i)/V(^'), 
and, in particular: 

lie* II > 2-('^-^)/Vi(i^')- 
Hence, for any x in L]r not in B we have: 

||x|| > min||e*||/2 > 2-("+i)/V(^')- 

i 

□ 

We can now finally prove Theorem 15.2. 1 . We split it in three parts: descrip- 
tion of the algorithm, proof of its correctness, and running time analysis. 

Proof [of Theorem 15.2.1] 
Description of the algorithm 

Let k and n be given, with the factorisation of n = WpP"^^^^ in prime 
factors. Let T := T(1,A;), and let r be its rank. Proposition 15.2.3 tells 
us that r < k/12 and that (Ti, . . . , Tr) is a Z-basis of T. Using modular 
symbols algorithms (see Chapter 8 of [Ste2]), one computes the Z-algebra 
structure of T, i.e., one computes T^Tj as linear combinations of the Ti, with 
1 < ^ < The identity (2.2.11) gives us: 

Tn = '^^TpVp(n) , Tpi = TpTpi-1 — ^Tpi-2, 

p\n 
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where p is prime and i > 2. Hence the computation of r„ is reduced to that 
of the Tp for the primes p dividing n. 

Let now ^? be a prime dividing n. Using a factorisation algorithm as 
in [Le-Le-Lo], we factor the Q-algebra Tq = Yl^ Ki as a product of fields. 
In fact, in all cases that we know of, the number of factors is at most 
one (see [Fa-Ja]). For each i, let Ai be the image of T 'm Ki. The Ai are 
computed as Z-algebra, and the surjections T — )• are described by the 
images of the Tj for j < r. These morphisms embed T into Hi^i- The 
computation of Tp is reduced to that of its images in the A^. 

Let K be one of the factors Ki, let Ahe Ai, let uk ■= dimq K and let 
dA '■= |discr(^)|. We define: 

(15.2.11) Ba := c-iilogdAf + n'ji + nK-k-logp), 
for c a suitable absolute constant. For all primes I with: 

6{k-l)<l<BAilogBA)^ 

we compute the maximal ideals of A/ 1 A, and order them by their norms: 
4j^{A/miA) < #{A/m2A), etc. Then we take j minimal such that: 

(15.2.12) #{A/mi ■ ■ ■ ruj) > (2(^K+i)/2.2.p{k-i)/2-^ _ 

For each of the rrii with i < j, we compute the Galois representation p^. as 
in Theorem 14.1.1, and a Frobenius element (Fiobp) at p as described 
in Section 15.1. Then we have the images of Tp in all T/mj for 1 < z < j. 

We compute a Z-basis e' = (e'^, . . . , e^^) of mi • • • rrij, starting from 
the Z-basis of A that is part of the description of A, adding the congruence 
condition modulo the mj's one by one. The LLL-algorithm gives us an 
LLL-reduced basis e of mi - ■ - mj. 

Let Tp denote the image of Tp in Yli^j A/rrii. We compute a preimage 
Tp in A of Tp, adding the congruence conditions one by one. We compute 
Tp itself with the algorithm of Proposition 15.2.10. 

Correctness of the algorithm 

We will now show that the computation works, and that it gives the correct 
result, if the constant c in (15.2.11) is large enough. 
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The first thing that we have to show is that there are distinct maximal 
ideals mi, ... ,mj of A, whose residue characteristics are between 6{k — 1) 
and Syi-(logSyi)^, not equal to p, and such that (15.2.12) holds. We note 
that for each I in that range there is at least one maximal ideal m in A/ 1 A, 
and that i^{A/m) is at least I. According to Corollary 10.1 in Section 1.2.6 
of [Ten], for sufficiently large real numbers x, the sum X^Kx^^sCO 
least x/2. So, indeed, taking all / between 6{k — 1) and a constant times 
riK-k- logp implies that the required rrii exist. We observe that the choice 
of Ba is sufficiently large for this. 

The second point where an argument is needed is that the are ei- 
ther reducible, or have image containing SL2(^/mj), so that they can be 
computed by the algorithm of Theorem 14.1.1. But this is guaranteed by 
Theorem 2.5.18. 

The third point is that in the situation where we invoke the algorithm of 
Proposition 15.2.10, the assumptions of that proposition hold. That means 
that we must check that ||Tp|| is strictly less than 2^("^*^+^)/^-^i(?n,i • • • rrij). 
By Deligne's bound of [Del2], we know that \\Tp\\ < .Jn^-l-p^^-^^l'^ . 
Lemma 15.2.9 says that n\{m\ ■ ■ ■ nij) > y/nK-i#{A/mi ■ ■ ■ rrij))^/'^^. 
Hence the required inequaUty follows from (15.2.12). This finishes the 
proof of the correctness of the algorithm. 

Running time analysis 

We show the two claims on the running time. We also indicate at the ap- 
popriate places that the algorithm is deterministic. 

Let A;, and n = fl^ be given. The computation of the Hecke algebra 
T := T(l, k), i.e., of the products TiTj as Z-Unear combinations of the Ti, 
with 1 < i,j,l < r, using modular symbols as in Chapter 8 of [Ste2], is 
deterministic and is done in time polynomial in k. Multiplication of two 
elements of T can be done in time polynomial in k and the maximum of 
the heights of the coordinates of the elements with respect to the Z-basis 
T = (Ti, . . .,Tr). Lemma 4.2.7 and (15.2.6) give that the heights of the 
coordinates of (with m G Z>o) with respect to T are 0(/c^ (log (/cm))). 
Hence the computation of r„ from the Tp for p dividing n is done in time 
polynomial in k and log n. The number of primes dividing n is at most 
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log2 n, and each of them is at most n. Let p be a prime dividing n. 

Factorisation as in [Le-Le-Lo] is a deterministic polynomial time algo- 
rithm, hence we do get the factorisation Tq = Yl - Ki and the surjections 
T — > C -fCj in time polynomial in k. 

The number of factors is at most r < A;/ 12. Let A be one of the Ai. 
As the morphism T — > is injective, we have: 

J|discr(^i) < discr(T) < (A;^ log A;)/12. 

i 

Therefore, the number Ba as in (15.2.11) is 0(fc^-((A;log fc)^ + logn)). 

For / a prime number, the computation of the maximal ideals of A/ 1 A 
can be done deterministically in time polynomial in I and uk as follows 
(compare with Algorithm 3.4.10 of [Coh], "Berlekamp for small primes"). 
Take i G Z>i such that > tik- The product I of the maximal ideals of 
A/ 1 A is the subspace of x with x'' = 0. This can be computed with hnear 
algebra over F;. One computes, again with hnear algebra, the sub-algebra 
{A/ 1 A)' of elements x with x} = x. This algebra is isomorphic to for 
some d. \i d > 1, then for any x in [A/lA)' that is not in F/ there is an a 
in F/ such that {x — a)'~^ is a non-trivial idempotent in {A/lA)' . Repeating 
this procedure splits {A /I A)' completely. The maximal ideal corresponding 
to an elementary idempotent l of {A/IA)' is then (1 — i)I. 

We conclude that the computation of all maximal ideals of the A/ 1 A, for 
all primes I with 6(A; — 1) < Z < B^ (logB^)^ can be done deterministi- 
cally in time polynomial in k and log n. We can order them by their norms 
during their computation. Then we have mi, . . . , ruj such that (15.2.12) 
holds. As i^{A/mi) > 2 for all i, we have: 

3 < nKi{nK + S)/2 + {k - l)(log2p)/2) = Oi^logn). 

Let m be one of the rrii, where i < j. Then #{A/m) < Z"^, where I is the 
largest prime with I < S^ (log-B^)^. A rough estimate gives that there is 
an absolute constant such that: 

#{A/mA) < (c-ifc^logn)*^/^ 

The running time for computing the Galois representation p^, is therefore 
bounded by a fixed power of {c-k^ log n)'^/^. For fixed k, this is of polyno- 
mial size in log n. Assuming GRH for K, we get a much smaller estimate 
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for ^{A/m) as follows. We use the fact that if a is in M>e, and x > 2a log a, 
then X I log a; > a (to prove this, use that x ^ xj log x is increasing on 
M>e, and that e/ log e > 2). We let x = BA-{iog Ba)"^- Then x satisfies the 
two hypotheses of Corollary 15.2.8 (assuming the constant c of (15.2.11) 
large enough with respect to C2 and C3), and therefore (here we use GRH!) 
7:{x,K) > x/21ogx. But then 7r{x,K) > Ba/2, i.e., there are at least 

Ba/2 maximal ideals of Ok with ^{OK/m) < x. Now Ok/ A is finite, 

1/2 

of order at most , hence there are at most (1/2)- log2 dA distinct primes 
dividing #{Ok/A), and hence at most (ni^/2)- log2 dA maximal ideals of 
A where A and Ok differ. Similarly, there are at most 6(A; — l)nK maximal 
ideals of A with residue characteristic at most 6{k — 1). The definition of 
Ba in equation (15.2.11) imphes that: 

6knK > riK — z h H — logaP , 



2 log a; 2 log2 dA 

assuming the absolute constant c large enough. Let / be the product of the 
maximal ideals m in ^ with #{A/m) < x and with residue characteristic 
at least 6(A; — 1). Using that for all m containing I we have #{A/m) > 2 
we get: 



/ \ 1 



The definition of j, see (15.2.12), implies that for every i < j, we have 
i^{A/mi) < X. As we have already noticed above, x is of size polynomial 
in k and log n. Summarising: if we assume GRH for K, then running time 
for the computation of pm is polynomial in k and log n. 

The computation of a Frobenius element ^^.(Frobp), given p^, is deter- 
ministic and has running time polynomial in k and log n; see the proof of 
Theorem 15.1.1. 

At this point we have computed the images of Tp in the A/nij, for all 
i < i- The computation of a Z-basis e' of nii • • - mj can be done in time 
polynomial in k and logn. One starts with the basis of A that is part of 
its description, and computes successively Z-bases of mi, mim2, etc. At 
the zth step, the maximum of the absolute values of the coordinates of the 
elements of our temporary basis with respect to the basis of A gets at most 
nKk times larger, where k is the characteristic of A/ rrii. It follows that the 
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absolute values of the coordinates of the e\ with respect to the basis of A are 
at most n-^- #{A/mi ■ ■ ■ rrij), which is of size polynomial in k and log n. 

The LLL -algorithm gives us an LLL-reduced basis e of mi ■ ■ ■ ruj in 
time polynomial in k and logn, see [Le-Le-Lo], [Len3] or [Coh, §2.6]. 

A preimage in A of the image Tp of Tp in j ^/"^i can be computed 
in time polynomial in k and log n as follows. One lifts the image of Tp 
in A /mi to an element Tp i of A, with small coordinates with respect to 
the Z-basis of A, then one adjusts Tpj with an element of mi with small 
coordinates with respect to the Z-basis that was already computed, to get the 
correct image in A/m2, etc. The size of the coordinates of with respect 
to the Z-basis of A is polynomial in k and log n. 

The algorithm of Proposition 15.2.10 then computes Tp for us, in time 
polynomial in k and log n. □ 

Proof [of CoroUary 15.2.2] Let A; > 0, and let / be in Mfe(SL2(Z), Z). We 
are given the integers k and the ai(/) for < i < A;/12, and a positive inte- 
ger n together with its factorisation into primes. We are to compute a„(/). 

If Mjt(SL2(Z), Z) is zero, then so is /, and we have a„(/) = 0. If A; = 0, 
then / is a constant power series, hence an(/) = 0- So, we may and do 
assume that k > 4, and that k is even. 

Let Ek be the Eisenstein form of weight k and level one normalised as in 
Example 2.2.3. Note that the coefficients ai{Ek) are rational numbers, not 
necessarily integers. Let g ■= f — ao{f )-Ek in S'fc(SL2(Z), Q). Then we 
have: 

/ = ao{f)-Ek + g, hence a„(/) = ao{f)an{Ek) + an{g). 

As the factorisation of n into primes is given, we can compute the coeffi- 
cient: 

2k , , 2k 
-(Jk-i{n) = - — 



in time polynomial in k and log n. Hence it remains to compute an{g). 

Let T denote the Hecke algebra T(l, k) acting on 5fc(SL2(Z), Z). Recall 
that its rank is at most k/12. Via the perfect pairing from (2.4.9): 

S'fe(SL2(Z),Z) X T — >Z, {h,t) ai{th) 
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we view g as the element in Homz-Mod(T, Q) that sends t to ai{tg). We 
then have, by (2.2.12): 

ar{g) = g{Tr) forallr>l. 

The Tj with 1 < i < rank(T) form a Z-basis for T, by Proposition 15.2.3. 
The products TjT, of these basis elements can be computed in time polyno- 
mial in k. 

The coefficients ai{Ek) for0<i<fc/12 can be computed in time poly- 
nomial in k from the standard formulas as given in Example 2.2.3. The co- 
efficients ai{f ) for < i < A;/12 are given. Hence the g{T,i) = ai{g) with 
1 < i < rank(T) are computed in time polynomial in k and the maximum 
of the log(l + |aj(/)|) with < i < k/12. Theorem 15.2.1 says that T„ can 
be computed as "L-Waedx combination of the Tj with 1 < i < rank(T), 
in time polynomial in k and logn. Applying g, viewed as element of 
Homz-ModCir,Q), to this Unear combination gives an{g) = g{Tn), in the 
required time. □ 



15.3 AN APPLICATION TO QUADRATIC FORMS 

In this section we apply our results on the computation of coefficients 
of modular forms to theta functions of even, unimodular positive definite 
quadratic forms over Z. According to Corollary 2.3.6, such a theta function 
is a modular form on SL2(Z), of weight equal to half the dimension of the 
space of the quadratic form. 

In view of Example 2.3.10, Theorem 15.1.1 has the following conse- 
quence. 

15.3.1 Theorem There is a deterministic algonthm that on input an inte- 
ger m > together with its factorisation into primes gives the representa- 
tion number rL{m) where L is the Leech lattice, in running time polynomial 
in log m. 

Let us now turn to arbitrary even unimodular lattices. We can then apply 
Corollary 15.2.2 to prove the following result. 
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15.3.2 Theorem Assume GRH. There is a deterministic algorittim that, on 
input the rank ni and the integers rL{i) for I < i < 71^/24 of an even uni- 
modular lattice {L, h), and an integer m > together with its factorisation 
into primes, computes r l {m) in running time polynomial in til and log (m) . 

Proof Let and the rL(i) for 1 < i < 71^/24 be given. As L is 
even and unimodular, is even (in fact, it is a multiple of 8, see [Ser5, 
VII, §6]). Let k := nL/2. Then Ol is in Mfc(SL2(Z), Z). The coefficients 
dii&L) = riC^i) with < i < k/12 are given to us. The fact that the open 
balls in L-g. centered at the x G -L and with radius 2~^/^ do not overlap gives 
that for i with < i < k/12 we have log(l + rL{i)) < A;log(l + k/6). 
Corollary 15.2.2 then means that rL{m) = a^f2{^L) can be computed in 
the required time. □ 

Let us point out that Theorem 15.3.2 can be applied to the orthogonal direct 
sum {L, b) of even unimodular lattices (Lj, 6j) for which the rL.(j) can be 
computed in time polynomial in n^. and j. Indeed: 



The coefficients ai{9L) with < i < 71^/24 can be computed in time 
polynomial in nz, by computing the product of the images of the 9 Li 




{bi{xi,Xl)-\ \-br{Xr,Xr))/2 _ Sr^^{x,x)/2 _ 




in Z[[g]]/(g"^/24+i). 
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Theorems 14.1.1 and 15.2.1 will certainly be generalised to spaces of cusp- 
forms of arbitrarily varying level and weight. This is currently being worked 
out for the probabilistic variants, and at least for square free levels (and for 
level two times a square free number for reasons that will become clear be- 
low). We describe some consequences of this current work. The reader 
will understand what the consequences are of deterministic generalisations 
to arbitrary levels and weights. 

Computation of Galois representations 

Peter Bruin will give, in his forthcoming PhD thesis (Summer 2010), a prob- 
abilistic algorithm that on input positive integers k and N, with square 
free, and a surjective morphism /: T(2A^, k) — > F to a finite field, com- 
putes pf with probabiUstic running time polynomial in k, N and #F. An 
important new ingredient in his method, suggested by Couveignes, is to 
be more flexible concerning the choice of the divisor Dq of Section 8.2. 
His algorithm computes, for each x in V, the smallest integer such that 
{Xi{2N)-q, Cx{dx-oo)) = 1, and then represents x by the unique effec- 
tive divisor of degree on Xi{2N)-^ such that x = [D^ — dx-oo] in 
Ji(2A^)(Q). This generaUses the probabilistic variant of Theorem 14.1.1 
that is described in Section 14.8. 

Computing coefficients of modular forms 

Concerning Theorem 15.2.1, Peter Bruin will obtain a probabilistic algo- 
rithm that, assuming GRH, on input positive integers k, N and n, with N 
squarefree, together with the factorisation of n into prime factors, the ele- 
ment Tn of the Hecke algebra T(2Ar, k) in probabiUstic running time poly- 
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nomial in k, N and log n. 

Lattices, sums of squares 

This last result, applied to theta functions of lattices as in Section 15.3, will 
have the following remarkable consequence that, assuming GRH, there is a 
probabilistic algorithm that on input positive integers k and n, together with 
the factorisation of n into prime factors, computes the number: 

rj2k{n) = i^{x&I?^ \xl + ---+ = n} 

in time polynomial in k and log n. 

For some small values of k there are well known expUcit formulas for 
the representation numbers r^2k{n), owing their existence to the fact that 
there are no non-CM cuspidal eigenforms on Fi (4) of weight k. In order 
to give these formulas, let x : Z — C be the map obtained from the char- 
acter (Z/4Z)^ = {1,-1} C C^, by extending it by zero to Z/4Z and 
composing the result with the reduction map Z Z/4Z. Then we have: 

rz2(n) = A^xid), 

d\n 

r-z4(n) = 8^(i+16 ^ d, 

2\d\n 2\d\(n/2) 
d\n d\n 

rz8(n) = 16^d^-32 ^ + 256 ^ d^, 

d\n d\{n/2) d\{n/A) 

rzio(n) = (4/5) x^"" + (64/5) ^ x(n/d)d^ 

d\n d\n 

+ (8/5) d\ 

d£l[i], |(i|2=n 

For the history of these formulas, featuring, among others, Fermat, Eu- 
ler, Lagrange, Legendre, Gauss, Jacobi and Liouville, we refer the reader 
to [Mil2] and to Chapter 20 of [Ha-Wr]. 

In her forthcoming masters thesis (Summer 2010), Ila Varma will show 
that there are no other values of k for which the theta function 9j;2h = B"^, 
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where 1?'^ is equipped with the standard inner product, is a linear combina- 
tion of Eisenstein series and cuspforms coming from Hecke characters. 

We conclude that, even in the absence of formulas as above, one will be 
able to compute the numbers rj2k (n) as fast as if such formulas existed. 
Often, theta functions are considered to be modular forms of which the co- 
efficients are easy to compute, and hence useful for computing Hecke oper- 
ators and coefficients of eigenforms. However, it seems that for coefficients 
o-n{f) with n large, this will be the other way around, from now on. 

Point counting on modular curves 

Another consequence of Peter Bruin's results mentioned above is that, again 
assuming GRH, there will be a probabilistic algorithm that on input a 
positive square free number n and a finite field ¥q computes the number 
#Xi(n)(Fq) in time polynomial in n and log q. Indeed, this is a matter of 
computing the element Tp (where p is the prime dividing q) in the Hecke 
algebra T(n, 2) acting on the space S'2(ri(n), Z). 

Point counting in a more general context 

The methods that we have used in this book can also be tried outside the 
context of modular forms. Let us consider, for example, a smooth surface 
S in Pq of degree at least 5, say. Letting I be a prime number, one has the 
cohomology groups H*(S'qp^,F/) for < i < 4, being finite dimensional 
F;-vector spaces with Gal(Q/Q)-action. It seems reasonable to suspect 
that, again, there is an algorithm that on input a prime / computes these 
cohomology groups, with their Gal(Q/Q)-action, in time polynomial in I. 
Once such an algorithm is known, one also has an algorithm that, on input 
a prime p of good reduction of S, gives the number #S{¥p) of Fp- valued 
points of S in time polynomial in log p. This result would be of interest 
because the known p-adic algorithms for finding such numbers have running 
time exponential in log p. 

In this case, we choose a Lefschetz fibration from a blow-up of S to Pq, 
and use the derived direct images of the constant sheaf F/ 5 under this fi- 
bration to compute the etale cohomology of Sq with F;-coefficients. The 
most complicated contribution then comes from the first derived image Ti, 
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which is a locally constant sheaf of F^-vector spaces of dimension r, say, 
with r independent of /, on the open part U of Pq over which the fibration 
is smooth. This open part U is independent of I as well, and it is the analog 
of the open part of the j-line over which all modular curves are unramified. 

For each Z let V/ := Isom[/(F[, Ti). These Vi play the role of the covers 
Xi{l) of the j-line, as, by definition, they trivialise the sheaves Ti. Each 
cover V/ — > [/ is finite Galois with group G = GLr{¥i), and H^([/q J7) 
is closely related to (VJ q cf which sits in the /-torsion of the Jacobian 
of the smooth projective model Vi of Vi. It is our hope that methods as in this 
book (height bounds, approximations) can show that there is a polynomial 
algorithm for computing these cohomology groups. 

In [Ed-dJ-Sc] a first step in this program is taken, by proving, in the func- 
tion field case, that, for varying I, the height of is bounded by a fixed 
power of I. 

Modular forms of half integral weight 

Much to our regret, we have nothing to say about modular forms of half inte- 
ger weight. Nevertheless, it would be very interesting to be able to compute 
coefficients of such modular forms, as they encode interesting arithmetic 
information, such as class numbers. 
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